¿Es seguro Maxbuttons?

Qué hace este plugin

• Slug: maxbuttons
• 70000+ instalaciones activas

butotn creatorcss wordpress buttoncss3 button generatorresponsive buttonsshare button

Estado de mantenimiento

• Última versión conocida: 9.8.6
• Requiere PHP: 7.0+
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

14 CVEs conocidos registrados para Maxbuttons.

CVE-2026-13245

The MaxButtons – Create buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'view' parameter in all versions up to, and including, 9.8.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-39444

The MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 9.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only impacts multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-10555

The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via via Button Width in all versions up to, and including, 9.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-6499

The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 9.7.8. This makes it possible for unauthenticated attackers to obtain the full path to instances, which they may be able to use in combination with other vulnerabilities or to simplify reconnaissance work. On its own, this information is of very limited use.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-3026

The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Custom Rel Tag' parameter in all versions up to, and including, 9.7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-7029

The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including 9.7.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially fixed in version 9.7.6.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2023-6594

The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 9.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Administrators can give button creation privileges to users with lower levels (contributor+) which would allow those lower-privileged users to carry out attacks.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2023-36503

Update the WordPress MaxButtons plugin to the latest available version (at least 9.6). Rafshanzani Suhada discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress MaxButtons Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 9.6.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

+ 8 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
CVE-2014-125092	MaxButtons – Create buttons [maxbuttons] < 1.26.1	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 1.26.1	1.26.1	2023-03-05	✓ corregido en la última versión
CVE-2022-36346	MaxButtons – Create buttons [maxbuttons] < 9.3	Falsificación de petición en sitios cruzados (CSRF)	Media 4,3	< 9.3	9.3	2022-08-02	✓ corregido en la última versión
CVE-2022-38703	MaxButtons – Create buttons [maxbuttons] < 9.3	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Baja 3,4	< 9.3	9.3	2022-07-29	✓ corregido en la última versión
CVE-2017-2169	MaxButtons – Create buttons [maxbuttons] < 6.19	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 6.19	6.19	2017-05-16	✓ corregido en la última versión
CVE-2014-7181	MaxButtons – Create buttons [maxbuttons] < 1.26.1	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Desconocido	< 1.26.1	1.26.1	2014-09-24	✓ corregido en la última versión
—	MaxButtons – Create buttons [maxbuttons] < 1.20.0	—	Desconocido	< 1.20.0	1.20.0	2014-08-01	✓ corregido en la última versión
CVE-2024-8968	MaxButtons – Create buttons [maxbuttons] < 9.8.1	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 4,7	< 9.8.1	9.8.1	0000-00-00	✓ corregido en la última versión
—	MaxButtons – Create buttons [maxbuttons] < 1.20.0	—	Desconocido	< 1.20.0	1.20.0	—	✓ corregido en la última versión

CVE-2014-125092

A vulnerability was found in MaxButtons Plugin up to 1.26.0 on WordPress and classified as problematic. This issue affects the function maxbuttons_strip_px of the file includes/maxbuttons-button.php. The manipulation of the argument button_id leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.26.1 is able to address this issue. The patch is named e74564c9e3b7429808e317f4916bd1c26ef0b806. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-222323. [de] Eine problematische Schwachstelle wurde in MaxButtons Plugin bis 1.26.0 für WordPress gefunden. Betroffen davon ist die Funktion maxbuttons_strip_px der Datei includes/maxbuttons-button.php. Mit der Manipulation des Arguments button_id mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Ein Aktualisieren auf die Version 1.26.1 vermag dieses Problem zu lösen. Der Patch wird als e74564c9e3b7429808e317f4916bd1c26ef0b806 bezeichnet. Als bestmögliche Massnahme wird das Einspielen eines Upgrades empfohlen.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2022-36346

The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 9.2. This is due to missing or incorrect nonce validation on the handlePost function. This makes it possible for unauthenticated attackers to change plugin settings via forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2022-38703

Update the WordPress MaxButtons plugin to the latest available version (at least 9.3). Muhammad Daffa discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress MaxButtons Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 9.3.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2017-2169

The WordPress plugin "MaxButtons" provided by Max Foundry contains a cross-site scripting vulnerability (CWE-79). ASAI Ken and Chris Liu reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: jvndb.jvn.jp

CVE-2014-7181

Reflected Cross-site scripting (XSS) vulnerability in the Max Foundry MaxButtons plugin before 1.26.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in a button action on the maxbuttons-controller page to wp-admin/admin.php, related to the button creation page. CVE-2014-125092 appears to be a duplicate of this issue.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

MaxButtons – Create buttons [maxbuttons] < 1.20.0

This plugin is prone to an authentication bypass vulnerability in includes/maxbuttons-button-css.php. Upgrade the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-8968

The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via via Text Color in all versions up to, and including, 9.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

MaxButtons – Create buttons [maxbuttons] < 1.20.0

The WordPress Button Plugin MaxButtons WordPress plugin was affected by an includes/maxbuttons-button-css.php Authentication Bypass security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Mantén Maxbuttons actualizado — 9.8.6 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.