WordPress MaxButtons Plugin <= 9.5.3 is vulnerable to Cross Site Scripting (XSS)

Vulnerability

Cross-Site Scripting vulnerability in the MaxButtons plugin (versions up to and including 9.5.3) for WordPress. Authenticated users with at least contributor-level access can inject malicious scripts through the plugin's button creation functionality. [1]

Exploitation

An attacker must have a WordPress account with contributor privileges or higher. They can craft a button with malicious JavaScript payloads that will be stored and executed when the button is rendered on a page. No additional user interaction beyond viewing the page is needed.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, defacement, or other client-side attacks. The scope is limited to the affected WordPress site.

Mitigation

The vulnerability is fixed in MaxButtons version 9.5.4 and later [1]. Users should update to the latest version (9.8.5 as of the reference). If unable to update, restrict contributor-level accounts or review button content for malicious code.