CVE-2024-1323

CVE-2024-1323 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Orbit Fox by ThemeIsle plugin for WordPress, specifically in versions up to and including 2.10.30. This flaw allows authenticated attackers with contributor-level permissions or higher to inject malicious web scripts into the Post Type Grid Widget Title due to insufficient input sanitization. The scripts execute when a user views the compromised page, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS score of 5.4 (MEDIUM), indicating a moderate severity. It requires user interaction (UI:R) and low privileges (PR:L) to exploit, but the attack complexity is low (AC:L). The potential impact includes limited confidentiality and integrity compromise (C:L, I:L). Currently, there is no evidence of active exploitation, and no public exploit code is available for Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting it has not garnered significant attention.