# Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More

> Add modules: share buttons, header/footer scripts, disable comments, reading progress, custom fonts, custom login & more in one plugin.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 09:34 UTC.

## Facts (WordPress.org)

- Slug: `themeisle-companion`
- Author: Themeisle
- Version: 3.0.13
- Active installs: 100,000+
- Last update: 2026-11-12 (1 day ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 5.3, PHP 7.4
- Tags: cookie notice, duplicate page, login customizer, share buttons, svg support
- Page: https://wordpress.org/plugins/themeisle-companion/

## Checks (against WordPress 7.1.4)

- OK: Updated 1 day ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Clashes ↔ Plays well, Cluttered ↔ Clean, Phones home ↔ Private, Paywalled ↔ Generous, Behind ↔ Current, Heavy ↔ Light.

## Known vulnerabilities

- 2026-09-09 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.0.8). CVE-2026-85418, https://www.wordfence.com/threat-intel/vulnerabilities/id/fc5b0f8f-2623-4d89-b78b-8dcc7289e306?source=api-prod
- 2026-08-05 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting (up to 3.0.7). CVE-2026-16583, https://www.wordfence.com/threat-intel/vulnerabilities/id/606a5fe1-d755-4ec0-843b-da3a033b73cf?source=api-prod
- 2026-07-27 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting (up to 3.0.7). CVE-2026-65563, https://www.wordfence.com/threat-intel/vulnerabilities/id/8b9ea717-65a3-49a3-80ca-a91797e8465c?source=api-prod
- 2026-06-18 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu-item-icon' Parameter (up to 3.0.6). CVE-2026-11358, https://www.wordfence.com/threat-intel/vulnerabilities/id/beb1268c-b680-4ebe-8fe2-65f656390038?source=api-prod
- 2025-11-03 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting via Post Taxonomy (up to 3.0.2). CVE-2025-12045, https://www.wordfence.com/threat-intel/vulnerabilities/id/139a264b-082b-45db-ac9e-4974bf86c56f?source=api-prod
- 2025-10-03 MEDIUM: Authenticated (Author+) Server-Side Request Forgery (up to 3.0.1). CVE-2025-10874, https://www.wordfence.com/threat-intel/vulnerabilities/id/26ac377f-c04d-4bc2-9238-3ae5c8d5b8ca?source=api-prod
- 2025-09-03 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.0.0). CVE-2025-58593, https://www.wordfence.com/threat-intel/vulnerabilities/id/093f69c8-890b-4885-81bf-e46d994c3fdb?source=api-prod
- 2025-02-03 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 2.10.44). CVE-2025-22659, https://www.wordfence.com/threat-intel/vulnerabilities/id/52ce7a69-7b65-4150-ad33-1a73ace63d93?source=api-prod
- 2025-01-09 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget (up to 2.10.43). CVE-2025-0311, https://www.wordfence.com/threat-intel/vulnerabilities/id/9d17a3a0-3c09-4d67-96d6-d97bde92f100?source=api-prod
- 2025-01-09 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag Parameter (up to 2.10.43). CVE-2024-13183, https://www.wordfence.com/threat-intel/vulnerabilities/id/d0f6be2b-5eb6-4828-ae95-7f2253700ee9?source=api-prod
- 2024-08-21 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (up to 2.10.36). CVE-2024-7778, https://www.wordfence.com/threat-intel/vulnerabilities/id/be83c6be-fb6c-462f-b54a-ca12d6d2581f?source=api-prod
- 2024-06-21 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Services and Post Type Grid Widgets (up to 2.10.34). CVE-2024-2484, https://www.wordfence.com/threat-intel/vulnerabilities/id/1bd0f172-2cd3-4839-9df9-64475554d3b2?source=api-prod
- 2024-03-07 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripiting via Registration Form Widget (up to 2.10.32). CVE-2024-2126, https://www.wordfence.com/threat-intel/vulnerabilities/id/020052ba-dece-4e70-88e7-8bd8918b8376?source=api-prod
- 2024-02-26 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 2.10.31). CVE-2024-1323, https://www.wordfence.com/threat-intel/vulnerabilities/id/0241a9fc-ce42-4a97-9f33-f07cf53c0f52?source=api-prod
- 2024-02-26 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via form widget addr2_width attribute (up to 2.10.30). CVE-2024-1497, https://www.wordfence.com/threat-intel/vulnerabilities/id/b4603b58-0972-4e04-91ac-ffc846964722?source=api-prod
- 2024-02-26 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 2.10.30). CVE-2024-1499, https://www.wordfence.com/threat-intel/vulnerabilities/id/df40eb21-2080-4de5-9055-09246a8a275e?source=api-prod
- 2024-02-01 MEDIUM: Missing Authorization (up to 2.10.28). CVE-2024-1047, https://www.wordfence.com/threat-intel/vulnerabilities/id/6147582f-578a-47ad-b16c-65c37896783d?source=api-prod
- 2024-02-01 MEDIUM: Cross-Site Request Forgery (up to 2.10.29). CVE-2024-1162, https://www.wordfence.com/threat-intel/vulnerabilities/id/88f6a24f-f14a-4d0a-be5a-f8c84910b4fc?source=api-prod
- 2024-01-15 MEDIUM: Authenticated(Contributor+) Stored Cross-site Scripting via Pricing Table Elementor Widget (up to 2.10.27). CVE-2024-0508, https://www.wordfence.com/threat-intel/vulnerabilities/id/ecc5a17e-c716-48bd-9b4d-49d870ae6bf3?source=api-prod
- 2024-01-05 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via custom fields (up to 2.10.26). CVE-2023-6781, https://www.wordfence.com/threat-intel/vulnerabilities/id/23e39019-c322-4027-84f2-faabd9ca4983?source=api-prod
- 2023-04-27 HIGH: Authenticated (Author+) Server-Side Request Forgery via URL (before 2.10.24). CVE-2023-2287, https://www.wordfence.com/threat-intel/vulnerabilities/id/4c30b925-47ca-4e14-a418-d9524648db2a?source=api-prod
- 2021-01-12 MEDIUM: Authenticated (Contributor+) Stored Cross Site Scripting (before 2.10.3). CVE-2021-24157, https://www.wordfence.com/threat-intel/vulnerabilities/id/b964df21-5648-4fe1-b2a7-99f8a0f02026?source=api-prod
- 2020-11-24 CRITICAL: Authenticated Privilege Escalation (before 2.10.3). CVE-2021-24158, https://www.wordfence.com/threat-intel/vulnerabilities/id/53c9d3d0-5fea-4e36-b356-8d3c0e672cac?source=api-prod
- 2018-11-12 HIGH: Improper REST Capabilities Checks (up to 2.6.3). WF-f53e5192-e809-400c-aed9-36b5d6415a9d, https://www.wordfence.com/threat-intel/vulnerabilities/id/f53e5192-e809-400c-aed9-36b5d6415a9d?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=themeisle-companion · HTML: https://todaywp.com/plugins/themeisle-companion