The Prague plugin for WordPress, provided by Fox‑themes, contains an improper input neutralization flaw that allows reflected cross‑site scripting. This flaw enables an attacker to inject crafted JavaScript into a page that a victim subsequently loads, potentially executing malicious code in the victim’s browser. The impact is the compromise of web‑application integrity and the possible theft of user data or session hijacking via the injected payload. The weakness is classified as CWE‑79, reflecting insufficient sanitization of user‑provided data during page rendering.

Fox‑themes Prague plugin versions up to and including 2.2.8 are affected. Any WordPress installation that uses these versions is vulnerable, regardless of site role or activity level. The vulnerability does not affect other Fox‑themes plugins or plugins from different vendors.

The vulnerability carries a CVSS score of 7.1, indicating a high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Given that it is a reflected XSS flaw, the likely attack vector is through crafted requests to the vulnerable plugin’s input fields or URL parameters. Exploitation does not require privileged access; an attacker can send a malicious link to an unwary user. Because the flaw resides in widely deployed WordPress code, the risk of exploitation is significant, especially for sites that have not upgraded beyond version 2.2.8.