Medium severity · published Aug 5, 2026
CVE-2026-16583
Orbit Fox by ThemeIsle < 3.0.8 - Author+ Stored XSS via SVG Upload
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.8 does not sanitize uploaded SVG files when its SVG upload feature is enabled, allowing authenticated users with the upload capability (Author and above by default, without the unfiltered_html capability) to upload SVG files containing JavaScript that executes in the site context when the file is viewed, leading to Stored Cross-Site Scripting.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OF
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More ·
3.0.0 before 3.0.8 · source: vendor
Affected product
OF
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-16583
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-16583
wpscan.com
https://wpscan.com/vulnerability/29b2b8af-2fd9-40f1-8843-d0f16cfb706b/
More from Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
5.5
CVE-2025-10874
Orbit Fox < 3.0.2 - Author+ Server-Side Request Forgery
5.4
CVE-2026-85418
Orbit Fox < 3.0.9 - Contributor+ Stored XSS via Beaver Builder Pricing Table Widget