CVE-2025-55422 identifies a reflected Cross Site Scripting (XSS) vulnerability in FoxCMS version 1.2.6 specifically in the /index.php/plus path. This vulnerability enables an attacker to inject and execute arbitrary scripts in the victim's browser, potentially leading to theft of sensitive information, session hijacking, or other malicious actions. The CVSS 3.1 base score of 8.8 reflects the vulnerability's network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of the victim's browser, resulting in high impact on confidentiality, integrity, and availability of user data and sessions. This can facilitate credential theft, session hijacking, or other malicious activities affecting users of the vulnerable FoxCMS instance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying web application firewall (WAF) rules to detect and block reflected XSS attempts targeting the /index.php/plus endpoint. Avoiding user interaction with suspicious links can also reduce risk.