Foxtool All-in-One: Contact chat button, Custom login, Media optimize images: Unauthorized media settings changes
A Subscriber can write attacker-selected subkeys of foxtool_settings through the media quick-toggle handler. Changing media-up3 can enable SVG uploads, creating a useful prerequisite for a separate SVG/script-upload chain; the record does not establish script execution from the settings change alone. Affected versions reported by the CNA: <= 2.5.3. Official changelog review confirms 2.5.4 as a fixed release for this issue.
- Component
- Foxtool All-in-One: Contact chat button, Custom login, Media optimize images
- Plugin slug
foxtool- Affected
- <= 2.5.3
- Safe version
2.5.4- Published
- Sep 18, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Sep 18, 2026 and is one of 2 known issues for this plugin.
Update, patch or deactivate.
The official changelog confirms a fix in 2.5.4: Protects media quick toggles with manage_options, accepted-key restrictions and administrator-only nonces. Update to that release or a later supported version. Official changelog: https://wordpress.org/plugins/foxtool/#developers Require manage_options and a valid request nonce, and allowlist the media settings that the quick-toggle handler may change.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary subkeys of the foxtool_settings option, including enabling site-wide SVG uploads by toggling the media-up3 key, which can facilitate stored cross-site scripting via malicious SVG files.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N