CVE-2023-6594

The MaxButtons plugin for WordPress contains a stored cross-site scripting vulnerability in versions up to 9.7.4 affecting the admin settings area. Insufficient sanitization and escaping of user input allows administrators and users with button creation privileges to inject malicious scripts that execute when pages are viewed. The vulnerability applies only to multisite installations or those with unfiltered_html disabled, and impacts lower-privileged users (contributors and above) when administrators grant them button creation capabilities.

Based on public CVE data (MITRE/NVD).