What is GHSA-j723-98hh-rm27?

GHSA-j723-98hh-rm27 is a security advisory published by GitHub Security Advisories with Medium severity. The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts \u0026 More...

Which CVE IDs does GHSA-j723-98hh-rm27 cover?

GHSA-j723-98hh-rm27 covers the following CVE IDs: CVE-2026-16583. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-j723-98hh-rm27?

GHSA-j723-98hh-rm27 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

GHSA-j723-98hh-rm27MediumCVSS 6.1

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More...

Vendor

GitHub Security Advisories

Published

August 5, 2026

Last Modified

August 5, 2026

🔗 CVE IDs covered (1)

CVE-2026-16583 →

📋 Description

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.8 does not sanitize uploaded SVG files when its SVG upload feature is enabled, allowing authenticated users with the upload capability (Author and above by default, without the unfiltered_html capability) to upload SVG files containing JavaScript that executes in the site context when the file is viewed, leading to Stored Cross-Site Scripting.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-16583
https://wpscan.com/vulnerability/29b2b8af-2fd9-40f1-8843-d0f16cfb706b
https://github.com/advisories/GHSA-j723-98hh-rm27