CVE-2021-24157: Themeisle Orbit Fox

Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days.

Orbit Fox by ThemeIsle has a feature to add custom scripts to the header and footer of a page or post. There were no checks to verify that a user had the unfiltered_html capability prior to saving the script tags, thus allowing lower-level users to inject scripts that could potentially be malicious.

Affected products

• Themeisle Orbit Fox: before 2.10.3 (fixed in 2.10.3)

Published 2021-04-05. Last modified 2026-06-17.