Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Foxtool All-in-One plugin lets logged‑in users change settings

CVE-2026-18317 · published 1 month ago
Summary

The Foxtool All-in-One plugin for WordPress does not properly check who is allowed to change its configuration. As a result, anyone with a basic user account can alter settings, such as turning on SVG image uploads, which could be used to embed malicious code. Update the plugin to the latest version or disable the vulnerable features until you can apply the update.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
foxtheme foxtool all-in-one: contact chat button, custom login, media optimize images <= 2.5.3
Original advisory text
Foxtool All-in-One: Contact chat button, Custom login, Media optimize images <= 2.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via 'option_key' Parameter of toggle_watermark AJAX Action
The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary subkeys of the foxtool_settings option, including enabling site-wide SVG uploads by toggling the media-up3 key, which can facilitate stored cross-site scripting via malicious SVG files.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published18 Sep 2026
Updated4 Nov 2026
First seen18 Sep 2026
Sources
CVE-2026-18317 · NVD
CVE-2026-18317 · MITRE
Track software like this
Free during beta