This vulnerability (CVE-2025-15654) in Fox-themes Prague is a reflected Cross-site Scripting (CWE-79) issue caused by improper input neutralization during web page generation. It affects all Prague versions up to 2.2.8. The CVSS 3.1 score of 7.1 indicates a high severity with network attack vector, low attack complexity, no privileges required, and user interaction needed. The vulnerability impacts confidentiality, integrity, and availability to a limited extent. No vendor advisory or patch information is available, and no known exploits have been reported in the wild.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to theft of sensitive information, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability. The reflected nature requires user interaction to trigger the attack. The CVSS vector indicates low complexity and no privileges required, increasing the risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider implementing web application firewall (WAF) rules or input validation as temporary mitigations. Monitor vendor channels for updates.