Executive brief
The MaxButtons plugin for WordPress, which is used to create and manage website buttons, contains a security flaw that allows for reflected cross-site scripting. An attacker could trick a user into clicking a malicious link, allowing the attacker to run unauthorized scripts in the user's browser. This could lead to the theft of sensitive information or unauthorized actions being performed on behalf of the user.
Technical details
The MaxButtons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'view' parameter. This vulnerability exists in versions up to and including 9.8.5. An unauthenticated attacker can exploit this by crafting a malicious URL and tricking a user (such as an administrator) into clicking it. If successful, the attacker can execute arbitrary JavaScript in the context of the victim's browser session. This can be used to hijack sessions, redirect users, or perform actions on the site as the victim. A patch has been released in the form of a changeset to address the sanitization issues.
Affected products
- maxfoundry MaxButtons – Create buttons up to, and including, 9.8.5
Timeline
- 2026-06-27: disclosed
- 2026-06-27: advisory
References
- https://plugins.trac.wordpress.org/browser/maxbuttons/tags/9.8.5/classes/controllers/listController.php
- https://plugins.trac.wordpress.org/browser/maxbuttons/tags/9.8.5/includes/maxbuttons-list.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3586921%40maxbuttons&new=3586921%40maxbuttons&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5805b1f1-34e7-49d5-93dd-748113b6093b?source=cve