CVE-2025-10874 — Orbit Fox < 3.0.2 - Author+ Server-Side Request Forgery

CVE-2025-10874

Orbit Fox < 3.0.2 - Author+ Server-Side Request Forgery PUBLISHED

Description (CNA)

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.2 does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing.

Affected (CNA)

Vendor / product	Versions
Unknown / Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More	affected 0 before 3.0.2

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/171ba43f-55b6-471d-af0a-be553baf639a/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.