CVE-2026-18317

Name of the Vulnerable Software and Affected Versions Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress versions prior to 2.5.4

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can modify arbitrary subkeys of the foxtool settings option. This includes the ability to toggle the media-up3 key to enable site-wide SVG uploads, which may lead to stored cross-site scripting (XSS)—a technique where malicious scripts are permanently stored on the target server—via malicious SVG files.

Recommendations Update the plugin to a version newer than 2.5.3.