CVE-2024-3026 WordPress Button Plugin MaxButtons < 9.7.8 - Editor+ Stored XSS

2024-07-1306:00:03

WPScan

github.com

wordpress

maxbuttons

xss

vulnerability

editor

cross-site scripting

AI Score

6.2

Confidence

High

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

The WordPress Button Plugin MaxButtons WordPress plugin before 9.7.8 does not sanitise and escape some parameters, which could allow users with a role as low as editor to perform Cross-Site Scripting attacks

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:maxfoundry:maxbuttons:*:*:*:*:*:wordpress:*:*"
    ],
    "vendor": "maxfoundry",
    "product": "maxbuttons",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "9.7.8",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unknown"
  }
]