Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?ButtonMaxButtonsButton GeneratorSocial Media Share Buttons & Social Sharing IconsButton BlockEasy PayPal Buy Now ButtonSimple Social Media Share ButtonsSpotify Play Button
Plugin · maxbuttons
MaxButtons
14 known vulnerabilities on record. Add your version above to see which ones affect you.
Jun 27, 2026MaxButtons – Create buttons: Reflected Cross-Site ScriptingCVE-2026-13245 · affects up to 9.8.5 · reported by WordfenceMedium 6.1
The MaxButtons – Create buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'view' parameter in all versions up to, and including, 9.8.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 17, 2025MaxButtons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39444 · affects up to 9.8.3 · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxfoundry MaxButtons maxbuttons allows Stored XSS.This issue affects MaxButtons: from n/a through <= 9.8.3.
Dec 20, 2024WordPress Button Plugin MaxButtons: Does not sanitise and escape some of its settingsCVE-2024-8968 · fixed in 9.8.1 · reported by WPScanMedium 4.7
The WordPress Button Plugin MaxButtons WordPress plugin before 9.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Dec 20, 2024WordPress Button Plugin MaxButtons: Does not sanitise and escape some of its settingsCVE-2024-10555 · fixed in 9.8.1 · reported by WPScanMedium 4.8
The WordPress Button Plugin MaxButtons WordPress plugin before 9.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Aug 24, 2024WordPress Button Plugin MaxButtons: Information exposureCVE-2024-6499 · affects up to 9.7.8 · reported by WordfenceMedium 5.3
The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 9.7.8. This makes it possible for unauthenticated attackers to obtain the full path to instances, which they may be able to use in combination with other vulnerabilities or to simplify reconnaissance work. On its own, this information is of very limited use.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 13, 2024WordPress Button Plugin MaxButtons: Does not sanitise and escape some parametersCVE-2024-3026 · fixed in 9.7.8 · reported by WPScanMedium 5.4
The WordPress Button Plugin MaxButtons WordPress plugin before 9.7.8 does not sanitise and escape some parameters, which could allow users with a role as low as editor to perform Cross-Site Scripting attacks
Feb 5, 2024WordPress Button Plugin MaxButtons: Stored Cross-Site ScriptingCVE-2023-7029 · affects up to 9.7.6 · fixed in 9.7.6 · reported by WordfenceMedium 6.4
The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including 9.7.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially fixed in version 9.7.6.
Jan 8, 2024WordPress Button Plugin MaxButtons: Stored Cross-Site ScriptingCVE-2023-6594 · affects up to 9.7.4 · reported by WordfenceMedium 4.4
The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 9.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Administrators can give button creation privileges to users with lower levels (contributor+) which would allow those lower-privileged users to carry out attacks.
Jul 25, 2023Auth.CVE-2023-36503 · affects up to 9.5.3 · reported by PatchstackMedium 6.5
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Max Foundry WordPress Button Plugin MaxButtons plugin <= 9.5.3 versions.
Mar 5, 2023A vulnerability was found in MaxButtons Plugin up to 1.26.0 on WordPress and classified as problematic.CVE-2014-125092 · affects up to 1.26.0 · reported by VulDBLow 3.5
A vulnerability was found in MaxButtons Plugin up to 1.26.0 on WordPress and classified as problematic. This issue affects the function maxbuttons_strip_px of the file includes/maxbuttons-button.php. The manipulation of the argument button_id leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.26.1 is able to address this issue. The patch is named e74564c9e3b7429808e317f4916bd1c26ef0b806. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-222323.
Sep 23, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Max Foundry Button Plugin MaxButtons plugin <= 9.2 at WordPressCVE-2022-38703 · affects up to 9.2 · reported by PatchstackLow 3.4
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Max Foundry Button Plugin MaxButtons plugin <= 9.2 at WordPress
Aug 22, 2022Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Max Foundry MaxButtons plugin <= 9.2 at WordPress.CVE-2022-36346 · affects up to 9.2 · reported by PatchstackMedium 4.3
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Max Foundry MaxButtons plugin <= 9.2 at WordPress.
May 22, 2017MaxButtons prior to version 6.19 and MaxButtons Pro prior to version 6.19: Cross-site scriptingCVE-2017-2169 · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in MaxButtons prior to version 6.19 and MaxButtons Pro prior to version 6.19 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Oct 16, 2014Cross-site scripting (XSS) vulnerability in the Max Foundry MaxButtons plugin before 1.26.1 for WordPress allows remote attackers to inject arbitrary web scriptCVE-2014-7181 · fixed in 1.26.1 · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Max Foundry MaxButtons plugin before 1.26.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in a button action on the maxbuttons-controller page to wp-admin/admin.php, related to the button creation page.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.