MEDIUM
foxtheme
CVE published 2026-09-18
CVE-2026-18317
The Foxtool All-in-One plugin for WordPress has an authorization bypass vulnerability in versions up to 2.5.3. Authenticated attackers with subscriber-level access can modify arbitrary subkeys of the foxtool_settings option, potentially enabling site-wide SVG uploads and facilitating stored cross-site scripting via malicious SVG files. This vulnerability allows attackers to bypass authorization checks, mo [truncated]