The Phox Hosting plugin for WordPress contains an improper neutralization of user input during web page generation, allowing a reflected cross‑site scripting flaw. A crafted request parameter is reflected back to the browser without sanitization, enabling an attacker to inject arbitrary client‑side scripts that execute in the context of the victim’s session. This can lead to theft of session cookies, credential bypass, phishing, or defacement of page content.

All installations of the Phox Hosting plugin up to and including version 2.0.8 are affected. Any WordPress site that has this plugin installed in those versions is vulnerable. Users visiting URLs that include the vulnerable parameters can be impacted.

The vulnerability has a CVSS score of 7.1, indicating a high level of risk. The likely attack vector is remote through a crafted URL that requires no special privileges; any user who loads the vulnerable page could be exploited. EPSS data is not available, and the issue is not listed in CISA’s Known Exploited Vulnerabilities catalog, but the combination of moderate‑high severity and a common XSS attack vector suggests that exploitation is plausible in the wild.