Unknown Orbit Fox By Themeisle vulnerabilities

3 vulnerabilities

Known vulnerabilities in Unknown Orbit Fox By Themeisle, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.4CVE-2021-24157themeisleorbit_fox+2
EPSS score
0.69%
Orbit Fox by ThemeIsle has a feature to add custom scripts to the header and footer of a page or post. There were no checks to verify that a user had the unfiltered_html capability prior to saving the script tags, thus allowing lower-level users to inject scripts that could potentially be malicious.9.9CVE-2021-24158themeisleorbit_fox+2
EPSS score
0.90%
Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality. As part of the registration form, administrators can choose which role to set as the default for users upon registration. This field is hidden from view for lower-level users, however, they can still supply the user_role parameter to update the default role for registration.7.4CVE-2023-2287themeisleorbitfox+2
EPSS score
0.56%
The Orbit Fox by ThemeIsle WordPress plugin before 2.10.24 does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing.