Cross-Site Request Forgery Vulnerability in Foxtool WordPress Plugin
CVE-2025-13408

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Foxtool All-in-one: Contact Chat Button, Custom Login, Media Optimize Images
Vendor
CVE Published:
12 December 2025

What is CVE-2025-13408?

The Foxtool All-in-One plugin for WordPress is susceptible to a Cross-Site Request Forgery (CSRF) attack due to inadequate nonce validation in the foxtool_login_google() function. This weakness enables unauthorized attackers to forge requests that can trick site administrators into executing malicious OAuth connections by simply clicking on a compromised link. All versions up to and including 2.5.2 are affected, highlighting the importance of proper nonce validation to safeguard against such attacks.

Affected Version(s)

Foxtool All-in-One: Contact chat button, Custom login, Media optimize images 0 <= 2.5.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.svn.wordpress.org/foxtool/tags/2.5.2/inc/...
https://wordpress.org/plugins/foxtool/

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

D01EXPLOIT OFFICIAL
.