Read the docs
TI-2021-06450 Aliases CVE-2021-24158GHSA-ghwx-pgfr-72jw

Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Privilege Escalation

Priority LOW 31CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-269.

Summary

Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality. As part of the registration form, administrators can choose which role to set as the default for users upon registration. This field is hidden from view for lower-level users, however, they can still supply the user_role parameter to update the default role for registration.

Why it matters now

EPSS 0.009 59th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Orbit Fox by ThemeIsle (Unknown): 2.10.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownOrbit Fox by ThemeIsle2.10.3 to before 2.10.32.10.3Patch availableCNA
  • Orbit Fox by ThemeIsle VendorUnknown Affected 2.10.3 to before 2.10.3 Fixed in 2.10.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:themeisle:orbit_fox:*:*:*:*:*:wordpress:*:*before 2.10.3Vulnerablethemeisle
  • cpe:2.3:a:themeisle:orbit_fox:*:*:*:*:*:wordpress:*:* Versions before 2.10.3 Vulnerable ·themeisle

Remediation

  • Fix · CNA Orbit Fox by ThemeIsle (Unknown) Fixed in 2.10.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Orbit Fox by ThemeIsle 2.10.3

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2021-06449 Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Stored Cross Site ScriptingPriority LOW 26
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24158
  2. 2026-10-03 Alias added: GHSA-ghwx-pgfr-72jw

References

Exploit 2

  • TI-2024-00968 ThemeIsle SDK <= Various Versions - Missing Authorization CVSS 3.1MEDIUM 5.3
  • TI-2025-16542 WordPress Orbit Fox by ThemeIsle plugin <= 2.10.44 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
  • TI-2024-12229 Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag Parameter CVSS 3.1MEDIUM 6.4
  • TI-2024-02310 Cross-site scripting in themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Support… CVSS 3.1MEDIUM 6.4
  • TI-2024-01976 Cross-site scripting in themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Support… CVSS 3.1MEDIUM 6.4
  • TI-2024-01400 Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 3.1MEDIUM 6.4
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences