The vulnerability is an unauthenticated Cross Site Scripting flaw in the WordPress FOX plugin versions up to 1.4.8. An attacker can inject arbitrary JavaScript into the output of the plugin, potentially hijacking user sessions, defacing content, or executing further malicious code in the victim’s browser. This weakness is classified as CWE‑79, which describes insecure handling of user input leading to script injection.

Affected users run RealMag777’s FOX plugin on WordPress sites with any versions from the initial release up to 1.4.8. The patch requires upgrading to 1.4.9 or later, which removes the vulnerable code paths. Sites using older releases are directly exposed.

The CVSS score of 7.1 signals a high severity, while the lack of an EPSS score indicates insufficient data on exploitation probability. The flaw is not listed in the CISA KEV catalog. Because the attack is unauthenticated, any website visitor could trigger the injection by supplying crafted input to the plugin’s publicly exposed endpoints. Administrators should treat this as a priority risk.