CVE-2025-13408

MediumCVSS 4.3

Published: 12/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

The Foxtool All-in-One plugin for WordPress up to version 2.5.2 contains a Cross-Site Request Forgery (CSRF) vulnerability. This is due to missing or incorrect nonce validation on the foxtool_login_google() function.

Risk Assessment

Unauthenticated attackers can establish an OAuth Connection via a forged request if they can trick a site administrator into performing an action such as clicking a link. This could lead to unauthorized access or account takeover.

Recommendation

Update the Foxtool All-in-One plugin to the latest available version that fixes this vulnerability. Also, educate administrators to avoid clicking suspicious links.

Other vulnerabilities in Foxtool All-in-One

CVE-2026-18317Medium
The Foxtool All-in-One plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.3 due to improper verification that a user is authorized to perform an action. An authenticated attacker with subscriber-level access and above can modify arbitrary subkeys of the foxtool_settings option, including enabling site-wide SVG uploads by toggling the media-up3 key, which can facilitate stored cross-site scripting via malicious SVG files.

Original NVD description (English source)

The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.2. This is due to missing or incorrect nonce validation on the foxtool_login_google() function. This makes it possible for unauthenticated attackers to establish an OAuth Connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS