CVE-2026-18317

The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary subkeys of the foxtool_settings option, including enabling site-wide SVG uploads by toggling the media-up3 key, which can facilitate stored cross-site scripting via malicious SVG files.

• CWE-862

• https://plugins.trac.wordpress.org/browser/foxtool/tags/2.5.3/inc/media.php#L854
• https://plugins.trac.wordpress.org/browser/foxtool/tags/2.5.3/inc/media.php#L868
• https://plugins.trac.wordpress.org/browser/foxtool/tags/2.5.3/inc/media.php#L926
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3659917%40foxtool&new=3659917%40foxtool
• https://www.wordfence.com/threat-intel/vulnerabilities/id/10864109-8155-414e-be96-58e4dc2401b1?source=cve

Published

Sep 18, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1831The YayMail - WooCommerce Email Customizer plugin for WordPr…2.7
• CVE-2026-18311Readwise Reader for Android contains a cross-site scripting …6.1
• CVE-2026-18312Readwise Reader for Android constructs URLs in its WebView u…6.1
• CVE-2026-18313rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPD…4.3
• CVE-2026-18315The TrueBooker – Appointment Booking and Scheduler System pl…9.8
• CVE-2026-18316The Solace Extra plugin for WordPress is vulnerable to unaut…9.1
• CVE-2026-1832The ThriveDesk – Live Chat, AI Chatbot, Helpdesk & Knowledge…4.3
• CVE-2026-18320Readwise Reader for Android uses a sanitize-html configurati…6.1
• CVE-2026-18321Buffer overflow in NTPsec's Zyfer refclock allows local atta…4.7
• CVE-2026-18322The Smart Popup by Supsystic plugin for WordPress is vulnera…8.8
• CVE-2026-18323The Forminator Forms – Contact Form, Payment Form & Custom F…7.2
• CVE-2026-18324The Forminator Forms – Contact Form, Payment Form & Custom F…7.2