CVE-2026-85418: Orbit Fox WordPress Plugin XSS Vulnerability

CVE-2026-85418 Overview

CVE-2026-85418 is a stored cross-site scripting (XSS) vulnerability in the Orbit Fox WordPress plugin versions before 3.0.9. The plugin fails to validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markup. Authenticated users with contributor-level access or above can inject arbitrary JavaScript that executes when any visitor views the affected page. The flaw is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Contributor-level accounts can persist JavaScript payloads that run in every visitor's browser session, enabling session theft, forced administrative actions, and phishing redirects.

Affected Products

Orbit Fox by ThemeIsle WordPress plugin versions prior to 3.0.9
Beaver Builder widget component bundled with Orbit Fox
WordPress sites permitting contributor-level or higher registrations

Discovery Timeline

2026-09-09 - CVE-2026-85418 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-85418

Vulnerability Analysis

The Orbit Fox plugin extends Beaver Builder with additional widgets for WordPress page building. One widget accepts an HTML tag name as a configurable parameter, intended to allow authors to choose semantic wrappers such as div, section, or article. The plugin echoes this value directly into the page markup without validating it against an allowlist or escaping the output.

An attacker with contributor privileges can supply a crafted tag name that breaks out of the intended element context and injects executable script. Because the payload is stored in the page content, every visitor rendering the page executes the injected code. The scope change reflected in the vulnerability scoring indicates that the injected script executes in the browser context of any user viewing the compromised page, not just the attacker.

Root Cause

The root cause is missing input validation on a widget attribute that is subsequently used to construct HTML markup. The Beaver Builder widget concatenates the attacker-controlled tag string into the output buffer without invoking WordPress escaping helpers such as tag_escape() or restricting the value to a fixed allowlist of safe tags.

Attack Vector

Exploitation requires an authenticated contributor account and user interaction from a visitor viewing the affected page. The attacker edits or creates a page that uses the vulnerable Beaver Builder widget, supplies a malicious tag name value, and saves the page. When the page renders publicly or under review, the injected script executes in the visitor's session context. Refer to the WPScan Vulnerability Report for the technical write-up.

Detection Methods for CVE-2026-85418

Indicators of Compromise

Unexpected <script> tags or on* event handlers within Beaver Builder widget markup stored in wp_posts.post_content
Orbit Fox widget attributes containing angle brackets, quote characters, or JavaScript keywords in tag-name fields
Contributor or author accounts editing pages that contain Beaver Builder layouts they did not previously author

Detection Strategies

Query the WordPress database for Orbit Fox widget shortcodes and inspect stored tag-name parameters for non-alphabetic characters
Deploy a web application firewall rule that inspects POST requests to admin-ajax.php and Beaver Builder save endpoints for HTML metacharacters in tag parameters
Review page revisions authored by contributor-level accounts for suspicious script content prior to publication

Monitoring Recommendations

Log and alert on all page publishing and update events performed by non-administrator roles
Monitor content security policy (CSP) violation reports for inline script executions on pages containing Beaver Builder widgets
Track outbound requests from visitor browsers to unfamiliar domains that may indicate exfiltration from injected scripts

How to Mitigate CVE-2026-85418

Immediate Actions Required

Update the Orbit Fox plugin to version 3.0.9 or later on all WordPress installations
Audit existing pages built with Beaver Builder for injected script content in Orbit Fox widgets
Review contributor and author accounts, revoking access for any that appear inactive or unauthorized

Patch Information

ThemeIsle addressed the vulnerability in Orbit Fox version 3.0.9 by validating the widget tag-name parameter before rendering. Site administrators should apply the update through the WordPress plugin management console or via WP-CLI. See the WPScan Vulnerability Report for advisory details.

Workarounds

Restrict contributor and author role assignments until the plugin update is applied
Deactivate the Orbit Fox Beaver Builder widget module if the update cannot be deployed immediately
Enforce a strict Content Security Policy that blocks inline scripts on public pages

bash

# Update Orbit Fox via WP-CLI
wp plugin update themeisle-companion --version=3.0.9
wp plugin list --name=themeisle-companion --field=version