--- title: "Themeisle Orbit Fox: Duplicate Page and 4 more models vulnerabilities and CVEs" url: https://radicalnotion.ai/vendor/themeisle/orbit-fox-duplicate-page-menu-icons-svg-support-cookie-notice-custom-fonts-and-more type: product description: "Themeisle Orbit Fox: Duplicate Page and 4 more models has 14 published CVEs, 0 in CISA KEV and 0 with public exploits." updated: 2026-06-18 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # Themeisle Orbit Fox: Duplicate Page and 4 more models vulnerabilities Vendor: [Themeisle](https://radicalnotion.ai/vendor/themeisle) - **Published CVEs:** 14 - **In CISA KEV:** 0 - **With a public exploit:** 0 - **With a patch:** 14 - **Average CVSS:** 6.0 - **First CVE:** 2024-01-11 - **Latest CVE:** 2026-06-18 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 0 | | High | 0 | | Medium | 14 | | Low | 0 | | Unscored | 0 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 11 | | [CWE-20](https://radicalnotion.ai/cwe/cwe-20) | Improper Input Validation | 1 | | [CWE-352](https://radicalnotion.ai/cwe/cwe-352) | Cross-Site Request Forgery (CSRF) | 1 | | [CWE-862](https://radicalnotion.ai/cwe/cwe-862) | Missing Authorization | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2024 | 10 | | 2025 | 3 | | 2026 | 1 | ## Affected versions | Version | Kind | CVEs | | --- | --- | --- | | \<= 2.10.30 | range | 2 | | \<= 2.10.43 | range | 2 | | \<= 2.10.26 | range | 1 | | \<= 2.10.27 | range | 1 | | \<= 2.10.28 | range | 1 | | \<= 2.10.29 | range | 1 | | \<= 2.10.31 | range | 1 | | \<= 2.10.32 | range | 1 | | \<= 2.10.34 | range | 1 | | \<= 2.10.36 | range | 1 | | \<= 3.0.2 | range | 1 | | \<= 3.0.6 | range | 1 | ## CVEs | CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-11358 | Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More \<= 3.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu-item-icon' Parameter | medium | 4.4 | No | No | Yes | | CVE-2025-12045 | Orbit Fox Companion \<= 3.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Post Taxonomy | medium | 6.4 | No | No | Yes | | CVE-2024-13183 | Orbit Fox by ThemeIsle \<= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via title\_tag Parameter | medium | 6.4 | No | No | Yes | | CVE-2025-0311 | Orbit Fox by ThemeIsle \<= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget | medium | 6.4 | No | No | Yes | | CVE-2024-7778 | Orbit Fox by ThemeIsle \<= 2.10.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload | medium | 6.4 | No | No | Yes | | CVE-2024-2484 | Orbit Fox by ThemeIsle \<= 2.10.34 - Authenticated (Contributor+) Stored Cross-Site Scripting via Services and Post Type Grid Widgets | medium | 6.4 | No | No | Yes | | CVE-2024-1499 | Orbit Fox by ThemeIsle \<= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting | medium | 6.4 | No | No | Yes | | CVE-2024-1497 | Orbit Fox by ThemeIsle \<= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via form widget addr2\_width attribute | medium | 6.4 | No | No | Yes | | CVE-2024-2126 | Orbit Fox by ThemeIsle \<= 2.10.32 - Authenticated (Contributor+) Stored Cross-Site Scripiting via Registration Form Widget | medium | 6.4 | No | No | Yes | | CVE-2024-1323 | Orbit Fox by ThemeIsle \<= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting | medium | 6.4 | No | No | Yes | | CVE-2024-0508 | Orbit Fox by ThemeIsle \<= 2.10.27 - Authenticated(Contributor+) Stored Cross-site Scripting via Pricing Table Elementor Widget | medium | 6.4 | No | No | Yes | | CVE-2024-1162 | Orbit Fox by ThemeIsle \<= 2.10.29 - Cross-Site Request Forgery | medium | 4.3 | No | No | Yes | | CVE-2024-1047 | ThemeIsle SDK \<= Various Versions - Missing Authorization | medium | 5.3 | No | No | Yes | | CVE-2023-6781 | Orbit Fox Companion \<= 2.10.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom fields | medium | 6.4 | No | No | Yes | ## Frequently asked questions ### How many CVEs does Themeisle Orbit Fox: Duplicate Page and 4 more models have? Themeisle Orbit Fox: Duplicate Page and 4 more models has 14 published CVE records since 2024. ### How many Themeisle Orbit Fox: Duplicate Page and 4 more models CVEs are in CISA KEV? None of Themeisle Orbit Fox: Duplicate Page and 4 more models's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Are there public exploits for Themeisle Orbit Fox: Duplicate Page and 4 more models vulnerabilities? No Themeisle Orbit Fox: Duplicate Page and 4 more models CVEs currently have a tracked public exploit in this dataset. ### Which versions of Themeisle Orbit Fox: Duplicate Page and 4 more models are affected? 12 distinct Themeisle Orbit Fox: Duplicate Page and 4 more models versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version. ### What are the most common weakness types in Themeisle Orbit Fox: Duplicate Page and 4 more models CVEs? Themeisle Orbit Fox: Duplicate Page and 4 more models's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-20 (Improper Input Validation), CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-862 (Missing Authorization). ### What is the average severity of Themeisle Orbit Fox: Duplicate Page and 4 more models CVEs? The average CVSS base score across Themeisle Orbit Fox: Duplicate Page and 4 more models's scored CVEs is 6.0. ## Other products from this vendor - [RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator](https://radicalnotion.ai/vendor/themeisle/rss-aggregator-by-feedzy-feed-to-post-autoblogging-news-and-youtube-video-feeds-aggregator) (17 CVEs) - [orbit fox](https://radicalnotion.ai/vendor/themeisle/orbit-fox) (15 CVEs) - [multiple page generator](https://radicalnotion.ai/vendor/themeisle/multiple-page-generator) (11 CVEs) - [Multiple Page Generator Plugin – MPG](https://radicalnotion.ai/vendor/themeisle/multiple-page-generator-plugin-mpg) (11 CVEs) - [Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE](https://radicalnotion.ai/vendor/themeisle/otter-blocks-gutenberg-blocks-page-builder-for-gutenberg-editor-and-fse) (11 CVEs) - [otter blocks](https://radicalnotion.ai/vendor/themeisle/otter-blocks) (10 CVEs) - [Redirection for Contact Form 7](https://radicalnotion.ai/vendor/themeisle/redirection-for-contact-form-7) (9 CVEs) - [rss aggregator by feedzy](https://radicalnotion.ai/vendor/themeisle/rss-aggregator-by-feedzy) (9 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/themeisle/orbit-fox-duplicate-page-menu-icons-svg-support-cookie-notice-custom-fonts-and-more). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.