{"id":"CVE-2026-85418","title":"The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rend…","summary":"The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rend…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"product":"Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More","affected":["orbit_fox_duplicate_page_menu_icons_svg_support_cookie_notice_custom_fonts_more < 3.0.9"],"published":"2026-09-09","updated":"2026-09-09","sourceUpdated":"2026-09-09T16:17:13.813","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85418","references":[{"url":"https://wpscan.com/vulnerability/8f9ba009-324f-46ef-853f-9f2e706c401e/","label":"contact@wpscan.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-09T15:22:32.751835Z"},"epss":0.00226,"epssPercentile":0.11826,"ingestedAt":"2026-09-09T07:03:03.595Z","slug":"CVE-2026-85418","body":"## Overview\n\nThe Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markup, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor views the affected page.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":19688,"id":"CVE-2026-85418","ts":1788970490450,"field":"cvss","old":null,"new":"5.4"},{"seq":19687,"id":"CVE-2026-85418","ts":1788970490450,"field":"severity","old":"none","new":"medium"}]}