Foxtool All In One
Monthly
Missing authorization checks in the Foxtool All-in-One plugin for WordPress (all versions up to and including 2.5.3) allow any authenticated subscriber-level user to modify arbitrary subkeys of the plugin's foxtool_settings option, including the media-up3 toggle that enables site-wide SVG uploads - a change that can be chained into stored cross-site scripting through a malicious SVG file rendered by a victim. The settings modification itself is unauthenticated only in the sense that no additional user interaction is required once a low-privileged account exists; exploitation therefore matters mainly on sites with open registration or untrusted subscriber accounts. Real-world risk is moderate-to-low: the direct impact is a limited integrity violation (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), the XSS escalation is conditional on a second step, and no public exploit code or active exploitation was identified at time of analysis.
Missing authorization checks in the Foxtool All-in-One plugin for WordPress (all versions up to and including 2.5.3) allow any authenticated subscriber-level user to modify arbitrary subkeys of the plugin's foxtool_settings option, including the media-up3 toggle that enables site-wide SVG uploads - a change that can be chained into stored cross-site scripting through a malicious SVG file rendered by a victim. The settings modification itself is unauthenticated only in the sense that no additional user interaction is required once a low-privileged account exists; exploitation therefore matters mainly on sites with open registration or untrusted subscriber accounts. Real-world risk is moderate-to-low: the direct impact is a limited integrity violation (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), the XSS escalation is conditional on a second step, and no public exploit code or active exploitation was identified at time of analysis.