CVE-2026-85418: Orbit Fox < 3.0.9 - Contributor+ Stored XSS via Beaver Builder Pricing Table Widget
The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markup, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor views the affected page.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with contributor-level access or higher can exploit it. The vulnerable input is in an Orbit Fox Beaver Builder widget, so exposure depends on those users being able to edit content that uses the affected widget.
When does the injected script run, and who is exposed?
The script executes when any visitor views the affected page. This can expose both unauthenticated visitors and logged-in users who load the page.
How can I determine whether a site is affected?
Sites using Orbit Fox versions before 3.0.9 are affected if they use the relevant Beaver Builder widget and have untrusted contributor-or-higher users who can supply its HTML tag name.