MaxButtons Plugin maxbuttons-button.php maxbuttons_strip_px cross site scripting

Vulnerability

A reflected cross-site scripting (XSS) vulnerability exists in the MaxButtons plugin for WordPress, affecting versions up to and including 1.26.0. The flaw resides in the maxbuttons_strip_px function within the file includes/maxbuttons-button.php. The button_id parameter is not properly sanitized or escaped before being processed, allowing an attacker to inject arbitrary HTML/JavaScript code. The attack can be carried out remotely without requiring authentication.

Exploitation

An attacker can craft a malicious URL containing a specially crafted button_id parameter. When a user with an active WordPress session visits this URL, the injected script executes in the context of the victim's browser session. No prior authentication, elevated privileges, or user interaction beyond visiting the crafted link is required. The exploit does not depend on any other plugin or theme settings beyond having the vulnerable version of MaxButtons installed and active.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser. This can lead to theft of session cookies, defacement of the admin interface, redirection to malicious sites, or other actions on behalf of the victim user. The attacker gains no direct access to the server, but can perform any action the victim is authorized to do, such as modifying button settings or creating new administrative users if the victim has sufficient privileges.

Mitigation

The issue is fixed in version 1.26.1, released on the same day as the initial discovery [1]. The patch, commit e74564c9e3b7429808e317f4916bd1c26ef0b806, properly sanitizes the button_id parameter [1]. Users are strongly advised to update to version 1.26.1 or later. No workaround is available for versions 1.26.0 and earlier, as the vulnerable code path cannot be disabled without installing the plugin update. The CVE is not listed on the KEV catalog as of the publication date.