CVE-2021-24157: themeisle orbit_fox Cross-site Scripting
Vulnerability summary
CVE-2021-24157 is a medium (CVSS 6.4) Cross-site Scripting vulnerability in themeisle orbit_fox. EPSS estimates a 0.69% chance of exploitation in the next 30 days, higher than 51.8% of scored vulnerabilities. 2 public exploits are recorded. Fixed in 2.10.3.
Timeline
- 05-04-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
Orbit Fox by ThemeIsle has a feature to add custom scripts to the header and footer of a page or post. There were no checks to verify that a user had the unfiltered_html capability prior to saving the script tags, thus allowing lower-level users to inject scripts that could potentially be malicious.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.69%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
0.00 pp
From 0.69% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (wpscan.com)
Maturity: unknown
Exploit Reference (wordfence.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Themeisle1 product
- orbit_fox< 2.10.3
Unknown1 product
- orbit fox by themeisle≥ 2.10.3, < 2.10.3
Wordpress1 product
- themeisle-companion< 2.10.3
3 vendors · 3 products
References
3 links- wpscan.com/vulnerability/28e42f4e-e38a-4bf4-b51b-d8f21c40f037X Refsource CONFIRMExploitThird Party Advisory
- www.wordfence.com/blog/2021/01/multiple-vulnerabilities-patched-in-orbit-fox-by-themeisle-plugin/X Refsource MISCExploitThird Party Advisory