Plugin icon

MaxButtons – Create buttons

maxbuttons

Vulnerabilities:

14

Last Updated:

June 26, 2026

Active Installs:

70000

Published
Title
Fixed in
CVSS
Published
2026-06-26
Title
MaxButtons < 9.8.6 - Reflected Cross-Site Scripting via 'view' Parameter
Fixed in
Fixed in 9.8.6
CVSS
6.1 (medium)
Published
2025-04-17
Title
MaxButtons < 9.8.4 - Admin+ Stored XSS
Fixed in
Fixed in 9.8.4
CVSS
3.5 (low)
Published
2024-11-29
Title
MaxButtons < 9.8.1 - Admin+ Stored XSS via Text Color
Fixed in
Fixed in 9.8.1
CVSS
3.5 (low)
Published
2024-11-29
Title
MaxButtons < 9.8.1 - Admin+ Stored XSS via Button Width
Fixed in
Fixed in 9.8.1
CVSS
3.5 (low)
Published
2024-08-23
Title
WordPress Button Plugin MaxButtons < 9.8.0 - Full Path Disclosure
Fixed in
Fixed in 9.8.0
CVSS
5.3 (medium)
Published
2024-06-22
Title
WordPress Button Plugin MaxButtons < 9.7.8 - Editor+ Stored XSS
Fixed in
Fixed in 9.7.8
CVSS
3.5 (low)
Published
2024-01-23
Title
WordPress Button Plugin MaxButtons < 9.7.7 - Contributor+ Stored XSS
Fixed in
Fixed in 9.7.7
CVSS
6.4 (medium)
Published
2024-01-08
Title
WordPress Button Plugin MaxButtons < 9.7.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
Fixed in
Fixed in 9.7.6
CVSS
4.4 (medium)
Published
2023-06-23
Title
MaxButtons < 9.6 - Contributor+ Stored XSS
Fixed in
Fixed in 9.6
CVSS
6.8 (medium)
Published
2022-08-02
Title
MaxButtons < 9.3 - Arbitrary Settings Update via CSRF
Fixed in
Fixed in 9.3
CVSS
4.3 (medium)
Published
2022-08-01
Title
Button Plugin MaxButtons < 9.3 - Admin+ Stored Cross-Site Scripting
Fixed in
Fixed in 9.3
CVSS
3.4 (low)
Published
2017-05-16
Title
WordPress Button Plugin MaxButtons <= 6.18 - Authenticated Cross-Site Scripting (XSS)
Fixed in
Fixed in 6.19
CVSS
6.1 (medium)
Published
2014-10-15
Title
MaxButtons 1.26.0 - Cross Site Scripting (XSS)
Fixed in
Fixed in 1.26.1
CVSS
n/a
Published
2014-08-01
Title
MaxButtons 1.19.0 - includes/maxbuttons-button-css.php Authentication Bypass
Fixed in
Fixed in 1.20.0
CVSS
n/a