Extension WordPress
Vulnérabilités MaxButtons – Create buttons
Cette page rassemble les failles publiées pour MaxButtons – Create buttons, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de MaxButtons – Create buttons
14 fiches
MaxButtons <= 9.8.5 – Reflected Cross-Site Scripting via 'view' Parameter
The MaxButtons – Create buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'view' parameter in all versions up to, and including, 9.8.5 due to insufficient input sanitization and output escaping. This makes it possible…
*-9.8.5
9.8.6
26/06/2026
MaxButtons <= 9.8.3 – Authenticated (Administrator+) Stored Cross-Site Scripting
The MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 9.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above,…
*-9.8.3
9.8.4
17/04/2025
WordPress Button Plugin MaxButtons <= 9.8.0 – Authenticated (Admin+) Stored Cross-Site Scripting via Button Width
The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via via Button Width in all versions up to, and including, 9.8.0 due to insufficient input sanitization and output escaping. This makes it possible…
*-9.8.0
9.8.1
29/11/2024
WordPress Button Plugin MaxButtons <= 9.8.0 – Authenticated (Admin+) Stored Cross-Site Scripting via Text Color
The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via via Text Color in all versions up to, and including, 9.8.0 due to insufficient input sanitization and output escaping. This makes it possible…
*-9.8.0
9.8.1
29/11/2024
WordPress Button Plugin MaxButtons <= 9.7.8 – Full Path Disclosure
The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 9.7.8. This makes it possible for unauthenticated attackers to obtain the full path to instances, which they may…
*-9.7.8
9.8.0
23/08/2024
WordPress Button Plugin MaxButtons <= 9.7.7 – Authenticated (Editor+) Stored Cross-Site Scripting
The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Custom Rel Tag' parameter in all versions up to, and including, 9.7.7 due to insufficient input sanitization and output escaping. This makes…
*-9.7.7
9.7.8
22/06/2024
WordPress Button Plugin MaxButtons <= 9.7.6 – Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including 9.7.6 due to insufficient input sanitization and output escaping on user supplied attributes.…
*-9.7.6
9.7.7
23/01/2024
WordPress Button Plugin MaxButtons <= 9.7.4 – Authenticated (Administrator+) Stored Cross-Site Scripting
The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 9.7.4 due to insufficient input sanitization and output escaping. This makes it possible for…
*-9.7.4
9.7.6
08/01/2024
MaxButtons <= 9.5.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 9.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible…
*-9.5.3
9.6
23/06/2023
MaxButtons <= 9.2 – Authenticated (Administrator+) Stored Cross-Site Scripting
The MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above,…
*-9.2
9.3
02/08/2022
WordPress Button Plugin MaxButtons <= 9.2 – Cross-Site Request Forgery
The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 9.2. This is due to missing or incorrect nonce validation on the handlePost function. This makes it possible…
*-9.2
9.3
02/08/2022
WordPress Button Plugin MaxButtons <= 9.2 – Shortcode-Based Cross-Site Scripting
The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via various shortcode attributes in versions up to, and including, 9.2 due to insufficient input sanitization and output escaping. This makes it possible for…
*-9.2
9.3
29/07/2022
MaxButtons <= 6.18 – Cross-Site Scripting
Cross-site scripting vulnerability in MaxButtons prior to version 6.19 and MaxButtons Pro prior to version 6.19 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
*-6.18
6.19
16/05/2017
MaxButtons < 1.26.1 – Reflected Cross-Site Scripting
Reflected Cross-site scripting (XSS) vulnerability in the Max Foundry MaxButtons plugin before 1.26.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in a button action on the maxbuttons-controller page to…
[*, 1.26.1)
1.26.1
24/09/2014
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.