CVE-2025-15654: Fox-themes Prague XSS Vulnerability

CVE-2025-15654 Overview

CVE-2025-15654 is a reflected Cross-Site Scripting (XSS) vulnerability in the Fox-themes Prague WordPress plugin. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Attackers can craft malicious URLs that execute arbitrary JavaScript in the browser of any victim who clicks the link. The vulnerability affects all Prague plugin versions up to and including 2.2.8. Successful exploitation requires user interaction but no authentication, and the scope is changed, meaning the injected script can affect resources beyond the vulnerable component.

Critical Impact

Attackers can hijack authenticated WordPress sessions, redirect administrators to malicious sites, or modify rendered page content by tricking users into clicking a crafted link.

Affected Products

• Fox-themes Prague plugin versions from n/a through 2.2.8
• WordPress sites running the Prague plugin
• Site administrators and authenticated users interacting with crafted URLs

Discovery Timeline

• 2026-06-03 - CVE-2025-15654 published to NVD
• 2026-06-04 - Last updated in NVD database

Technical Details for CVE-2025-15654

Vulnerability Analysis

The Prague plugin fails to properly sanitize or encode user-controlled input before reflecting it back into HTML responses. When a victim loads a URL containing attacker-supplied parameters, the plugin renders those values directly into the page output. The browser then parses the injected payload as executable script. Because the attack vector is network-based and requires no privileges, any unauthenticated attacker can craft a weaponized link. User interaction is required, which aligns with reflected XSS exploitation patterns where victims must visit the malicious URL.

Root Cause

The root cause is missing or insufficient output encoding on request parameters that flow into HTML response contexts. The plugin trusts client-supplied input and emits it without applying WordPress sanitization helpers such as esc_html(), esc_attr(), or wp_kses(). This pattern [CWE-79] allows raw <script> tags or event-handler attributes to break out of the intended HTML context and execute in the victim's session.

Attack Vector

An attacker constructs a URL pointing to a vulnerable Prague plugin endpoint with a payload embedded in a reflected parameter. The attacker distributes this link through phishing emails, social media, or compromised third-party sites. When an authenticated WordPress user clicks the link, their browser submits the payload, the server reflects it, and the script executes under the site's origin. The injected JavaScript can steal session cookies, perform actions on behalf of the user, or rewrite page content. The scope change indicator means the script can impact data outside the plugin's security boundary, including the broader WordPress admin context.

No verified public proof-of-concept code is available. See the Patchstack WordPress Vulnerability Report for advisory details.

Detection Methods for CVE-2025-15654

Indicators of Compromise

• Web server access logs containing query strings with <script>, javascript:, onerror=, or URL-encoded equivalents such as %3Cscript%3E targeting Prague plugin endpoints.
• Outbound requests from administrator browsers to attacker-controlled domains shortly after clicking external links.
• Unexpected WordPress administrative actions originating from legitimate admin sessions.

Detection Strategies

• Inspect HTTP request logs for reflected parameter values containing HTML or JavaScript metacharacters routed to Prague plugin paths.
• Deploy a Web Application Firewall (WAF) rule set that flags XSS payload patterns targeting WordPress plugin parameters.
• Correlate referrer headers from external domains with subsequent privileged actions inside /wp-admin.

Monitoring Recommendations

• Enable WordPress audit logging to capture changes made by administrator accounts and the source IP of each action.
• Forward web server and WordPress logs to a centralized logging platform for anomaly review.
• Monitor browser-side Content Security Policy (CSP) violation reports for blocked inline script executions.

How to Mitigate CVE-2025-15654

Immediate Actions Required

• Identify all WordPress instances running the Fox-themes Prague plugin at version 2.2.8 or earlier.
• Disable or remove the plugin until a patched release is verified and applied.
• Force a logout of active administrator sessions and rotate WordPress credentials and secret keys defined in wp-config.php.
• Review recent administrative activity for unauthorized user creation, option changes, or content modifications.

Patch Information

At the time of publication, the advisory lists affected versions through 2.2.8. Consult the Patchstack WordPress Vulnerability Report for the latest fixed version information and apply the vendor update as soon as it is available.

Workarounds

• Place the WordPress site behind a WAF configured to block reflected XSS payloads in query strings and POST bodies.
• Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
• Restrict /wp-admin access by IP allowlist to reduce exposure of authenticated sessions to phishing-delivered links.

# Example nginx rule to block obvious XSS payloads targeting Prague plugin paths
location ~* /wp-content/plugins/prague/ {
    if ($args ~* "(<|%3C)script") { return 403; }
    if ($args ~* "javascript:")    { return 403; }
    if ($args ~* "onerror=")       { return 403; }
}