Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 56% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price.

1. ★★★★★ jenoneilmedia

   1.3y ago

   Thank you for providing this to us!

   Read on wp.org ↗
2. ★★★★★ yeyocaribe

   2.5y ago

   Work fine, I liked

   Read on wp.org ↗
3. ★★★★★ TC Lynch

   2.9y ago

   I only seemed to use a couple of the features after testing it for awhile.

   Read on wp.org ↗
4. ★★★★★ jarlhalla

   3.0y ago

   Thank you for this and great job!

   Read on wp.org ↗
5. ★★★★★ moncreta

   3.1y ago

   Great sets of modules with excellent responsiveness.

   Read on wp.org ↗
6. ★★★★★ swevenventuresllp

   3.3y ago

   Great Plugin

   Read on wp.org ↗
7. ★★★★★ groso

   3.3y ago

   Thanks for your work!

   Read on wp.org ↗
8. ★★★★★ memo88

   3.4y ago

   A solution that satisfies all needs is perfect and demanding for me! Thank you very much!

   Read on wp.org ↗

Recent releases and news for this plugin

1. 2026-07-30 Version 3.0.9 Improved Security by sanitizing tags to prevent XSS 3.0.9
2. 2026-07-23 Version 3.0.8 Updated dependencies Improved Security Thanks to Shivamani Vastrala for responsibly reporting the issues. 3.0.8
3. 2026-06-16 Version 3.0.7 Enhanced security 3.0.7
4. 2026-05-25 Version 3.0.6 Updated dependencies 3.0.6
5. 2025-12-05 Version 3.0.5 Fixed issue related to Elementor widgets module causing error in Hestia theme 3.0.5
6. 2025-12-04 Version 3.0.4 Fixed pagination of Grid Post Type 3.0.4

23 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 6.4 Orbit Fox by ThemeIsle <= 3.0.7 - Authenticated (Author+) Stored Cross-Site Scripting ↗
   2026-07-27 CVE-2026-16583 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.0.7 Patched in 3.0.8
2. Medium · 6.4 Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More <= 3.0.7 - Authenticated (Author+) Stored Cross-Site Scripting ↗
   2026-07-24 CVE-2026-65563 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.0.7 Patched in 3.0.8
3. Medium · 4.4 Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More <= 3.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu-item-icon' Parameter ↗
   2026-06-17 CVE-2026-11358 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.0.6 Patched in 3.0.7
4. Medium · 6.4 Orbit Fox Companion <= 3.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Post Taxonomy ↗
   2025-11-03 CVE-2025-12045 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.0.2 Patched in 3.0.3
5. Medium · 6.4 Orbit Fox by ThemeIsle <= 3.0.1 - Authenticated (Author+) Server-Side Request Forgery ↗
   2025-10-03 CVE-2025-10874 Server-Side Request Forgery (SSRF) Affects <= 3.0.1 Patched in 3.0.2
6. Medium · 6.4 Orbit Fox by ThemeIsle <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2025-09-03 CVE-2025-58593 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.0.0 Patched in 3.0.1
7. Medium · 6.4 Orbit Fox by ThemeIsle <= 2.10.44 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2025-02-03 CVE-2025-22659 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.10.44 Patched in 2.10.45
8. Medium · 6.4 Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag Parameter ↗
   2025-01-09 CVE-2024-13183 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.10.43 Patched in 2.10.44
9. Medium · 6.4 Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget ↗
   2025-01-09 CVE-2025-0311 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.10.43 Patched in 2.10.44
10. Medium · 6.4 Orbit Fox by ThemeIsle <= 2.10.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ↗
    2024-08-21 CVE-2024-7778 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.10.36 Patched in 2.10.37
11. Medium · 6.4 Orbit Fox by ThemeIsle <= 2.10.34 - Authenticated (Contributor+) Stored Cross-Site Scripting via Services and Post Type Grid Widgets ↗
    2024-06-21 CVE-2024-2484 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.10.34 Patched in 2.10.35
12. Medium · 6.4 Orbit Fox by ThemeIsle <= 2.10.32 - Authenticated (Contributor+) Stored Cross-Site Scripiting via Registration Form Widget ↗
    2024-03-07 CVE-2024-2126 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.10.32 Patched in 2.10.33
13. Medium · 6.4 Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-02-26 CVE-2024-1323 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.10.31 Patched in 2.10.32
14. Medium · 6.4 Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via form widget addr2_width attribute ↗
    2024-02-26 CVE-2024-1497 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.10.30 Patched in 2.10.31
15. Medium · 6.4 Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-02-26 CVE-2024-1499 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.10.30 Patched in 2.10.31
16. Medium · 5.3 ThemeIsle SDK <= Various Versions - Missing Authorization ↗
    2024-02-01 CVE-2024-1047 Missing Authorization Affects <= 2.10.28 Patched in 2.10.29
17. Medium · 4.3 Orbit Fox by ThemeIsle <= 2.10.29 - Cross-Site Request Forgery ↗
    2024-02-01 CVE-2024-1162 Cross-Site Request Forgery (CSRF) Affects <= 2.10.29 Patched in 2.10.230
18. Medium · 6.4 Orbit Fox by ThemeIsle <= 2.10.27 - Authenticated(Contributor+) Stored Cross-site Scripting via Pricing Table Elementor Widget ↗
    2024-01-15 CVE-2024-0508 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.10.27 Patched in 2.10.28
19. Medium · 6.4 Orbit Fox Companion <= 2.10.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom fields ↗
    2024-01-05 CVE-2023-6781 Improper Input Validation Affects <= 2.10.26 Patched in 2.10.27
20. High · 7.4 Orbit Fox by ThemeIsle <= 2.10.23 - Authenticated (Author+) Server-Side Request Forgery via URL ↗
    2023-04-27 CVE-2023-2287 Server-Side Request Forgery (SSRF) Affects < 2.10.24 Patched in 2.10.24
21. Medium · 6.4 Orbit Fox by ThemeIsle <= 2.10.2 - Authenticated (Contributor+) Stored Cross Site Scripting ↗
    2021-01-12 CVE-2021-24157 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 2.10.3 Patched in 2.10.3
22. Critical · 9.9 Orbit Fox by ThemeIsle <= 2.10.2 - Authenticated Privilege Escalation ↗
    2020-11-24 CVE-2021-24158 Improper Privilege Management Affects < 2.10.3 Patched in 2.10.3
23. High · 7.3 Orbit Fox by ThemeIsle <= 2.6.3 - Improper REST Capabilities Checks ↗
    2018-11-12 Missing Authorization Affects <= 2.6.3 Patched in 2.6.4

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 33 languages, 3 at 90% or more · development strings

Plus 9 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2025-09-30 200K+ → 100K+ down after 827 days in tier
2. 2023-06-26 300K+ → 200K+ down

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Duplicate Page 3M+ installs · 4.8★ · 1 shared tag B
• CookieYes – Cookie Banner for Cookie Consent (Easy to setup GDPR/CCPA Compliant Cookie Notice) 1M+ installs · 4.8★ · 1 shared tag A
• Complianz GDPR/CCPA Cookie Consent Banner 1M+ installs · 4.7★ · 1 shared tag A
• AddToAny Share Buttons 300K+ installs · 4.7★ · 1 shared tag A
• LoginPress | wp-login Custom Login Page Customizer 200K+ installs · 4.8★ · 1 shared tag A
• WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) 200K+ installs · 4.7★ · 1 shared tag A

Embed this report card

Drop a live Pulse card for Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More into a readme, a review or a deck. It updates itself.

Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More: 100K+ active installs, 4.8★ (317 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/themeisle-companion