CVE-2025-15654Disclosure

LOWCVSS 7.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fox-themes Prague allows Reflected XSS. This issue affects Prague: from n/a through 2.2.8.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

https://patchstack.com/database/wordpress/plugin/prague-plugins/vulnerability/wordpress-prague-plugin-2-2-8-cross-site-scripting-xss-vulnerability?_s_id=cve

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-06-03); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets1 URL

By indicator

https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-15654

Full discourse2 posts

White Rabbitx 🏴‍☠️@TheRabbitPy135d
Disclosure
24 HIGH-severity CVEs dropped today. Key ones to watch: 🔥 AI/ML: CVE-2026-5241: huggingface/transformers ... RCE via trust_remote_code bypass when loading LightGlue models (even with trust_remote_code=False) 💥 Buffer Overflow → Root: CVE-2026-35085/84/83: gdv-serverconfig, dali-devconfig ... stack overflow → full root CVE-2022-49042/036: Synology ... local RCE via MinGW DLL & OpenSSL config 📁 Arbitrary File Ops (user → root): CVE-2026-35082/80/79/78/77/76: ugw-* & bac-scanresult ... read/terminate/delete arbitrary files & processes 🌐 Web/App: CVE-2025-15655: Mojoomla ... SQL injection CVE-2025-15654: Fox-themes Prague ... Reflected XSS CVE-2025-14772/73: ABB T-MAC Plus ... auth bypass + XSS 🔧 PrivEsc: CVE-2025-41259: SWUpdate ... TOCTOU → root CVE-2025-15656: Mojoomla ... privilege escalation 📡 Network: CVE-2026-37460: FRRouting ... crafted BGP UPDATE → DoS Patch priority: AI infra, Synology backups, ugw devices, SWUpdate, Mojoomla, ABB T-MAC.
Post summary
The post announces 24 high‑severity CVEs discovered today across multiple domains, details their exploitation potential, and lists prioritized patches for affected systems.
11000129
1.3K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds136d
Disclosure
CVE-2025-15654 Reflected Cross-Site Scripting Vulnerability in Fox-Themes Prague Through 2.2.8 https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-15654
Post summary
The text announces a reflected XSS vulnerability (CVE-2025-15654) in Fox-Themes Prague (≤ 2.2.8), lists its title, and provides a link to more details, but provides no PoC, exploit, or patch information.
0000044
4.0K followersView on X

Explore more

Back to dashboard