CVE-2026-16583

This stored XSS in the Orbit Fox WordPress plugin (versions before 3.0.8) carries a 6.1 CVSS, but the 0.00181 EPSS score tells a different story: automated mass exploitation is essentially nil. The gap is real and instructive. The vulnerability requires an authenticated user with Author role or higher who has upload capability but lacks the unfiltered_html capability — a narrow slice of WordPress role configurations. You won't find this exploited by opportunistic scanners. The calculation changes dramatically for targeted attacks. When that Author uploads a malicious SVG, execution triggers not when the Author visits the file — it triggers when an administrator reviews it in the WordPress dashboard. Admins typically have execute_unfiltered_html, which means this stored XSS can potentially escalate to server-side code execution through plugin or theme editor access. That's the real danger this CVE captures: from upload capability to full host compromise in two steps. The CVSS 6.1 reflects that conditional impact better than the EPSS reflects automated risk. The fix in 3.0.8 appears to restrict upload capability rather than implement proper SVG sanitization. That's a surgical amputation — it neutralizes the immediate threat but leaves the underlying upload handler code in place. If an administrator re-enables the feature or another plugin restores SVG upload functionality, the vulnerable code path remains documented in every commit diff. Sites running 3.0.7 should treat this as urgent because the attack chain requires neither sophistication nor luck once an authenticated session exists — it just requires a specific user role configuration that many WordPress sites actually have.

Reviewed through automated stages and approved by a human before publication.