EUVD-2026-39944
GHSA-cg33-79v8-8w6f
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-reachable, no privileges needed, but UI:R required; scope changes to victim browser; no availability impact applies.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The MaxButtons - Create buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'view' parameter in all versions up to, and including, 9.8.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
AnalysisAI
Reflected Cross-Site Scripting in the MaxButtons - Create buttons WordPress plugin (versions up to and including 9.8.5) allows unauthenticated attackers to inject arbitrary JavaScript via the unsanitized 'view' parameter, executing in the victim's browser context when a crafted URL is clicked. The flaw is traced to insufficient input sanitization in listController.php and maxbuttons-list.php, as confirmed by Wordfence and source-level references in the WordPress plugin repository. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and zero-privilege requirement make social-engineering-based exploitation straightforward.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes this class of flaw: user-supplied input is reflected into the HTML response without adequate sanitization or context-aware output escaping. The vulnerable parameter 'view' is processed in listController.php (line 38) and rendered in maxbuttons-list.php (line 62), both accessible via unauthenticated HTTP requests. Because the reflected payload executes in the context of the WordPress site origin, an attacker can leverage the browser's same-origin policy to access session cookies, perform authenticated actions on behalf of the victim, or inject credential-harvesting forms. The scope change (S:C in the CVSS vector) captures this cross-context impact: the vulnerable component is the WordPress plugin, but the affected component is the victim's browser session.
RemediationAI
Update the MaxButtons plugin to the version corresponding to or newer than SVN changeset 3586921 (plugins.trac.wordpress.org/changeset?reponame=&old=3586921%40maxbuttons&new=3586921%40maxbuttons), which contains the upstream fix. The exact released version number following 9.8.5 is not independently confirmed from the available data, so administrators should verify the current version in the WordPress plugin repository or the Wordfence advisory at wordfence.com/threat-intel/vulnerabilities/id/5805b1f1-34e7-49d5-93dd-748113b6093b. If immediate patching is not possible, a compensating control is to deactivate the MaxButtons plugin until the fix is applied - this eliminates the attack surface with no operational side effect other than losing button functionality. Additionally, deploying a WAF rule to block reflected XSS payloads in the 'view' parameter can reduce exposure, though WAF bypass techniques exist and this should not substitute for patching.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today