CVE-2023-7029

CVE-2023-7029 affects the WordPress MaxButtons plugin. The vulnerability is a Stored Cross-Site Scripting (XSS) in shortcode attributes due to insufficient input sanitization and output escaping, exploitable by authenticated users with contributor-level access and above. All versions up to 9.7.6 ...

CVE-2014-125092

CVE-2014-125092 affects the WordPress MaxButtons Plugin up to version 1.26.0. The vulnerability targets the function maxbuttons_strip_px in includes/maxbuttons-button.php, where manipulation of the button_id parameter leads to a cross-site scripting (XSS) flaw. The issue may be triggered remotely...

CVE-2024-6499

CVE-2024-6499 refers to the WordPress Button Plugin MaxButtons vulnerability. The MaxButtons plugin (WordPress Button Plugin MaxButtons) versions up to and including 9.7.8 expose full filesystem paths, enabling unauthenticated attackers to obtain instance paths. The risk is information exposure w...

CVE-2024-3026

The WordPress Button Plugin MaxButtons WordPress plugin before 9.7.8 does not sanitise and escape some parameters, which could allow users with a role as low as editor to perform Cross-Site Scripting attacks

CVE-2024-10555

The MaxButtons WordPress plugin (versions before 9.8.1 ) contains a vulnerability where it fails to properly sanitise and escape certain settings, specifically related to button width . This flaw allows high-privilege users, such as administrators, to perform Stored Cross-Site Scripting (XSS) att...

CVE-2024-8968

The MaxButtons WordPress plugin (versions prior to 9.8.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to the failure to properly sanitize and escape certain settings, specifically related to the text color configuration. This vulnerability allows high-privilege users, such as administ...