CVE-2023-7029

The MaxButtons plugin for WordPress contains a stored cross-site scripting vulnerability affecting versions up to 9.7.6, caused by inadequate sanitization of user input and escaping of output within the plugin's shortcode attributes. Authenticated users with contributor privileges or higher can inject malicious scripts into pages through these attributes, and the scripts execute when other users view the affected pages. Although a partial fix was attempted in version 9.7.6, the vulnerability was fully resolved in version 9.7.7.

Based on public CVE data (MITRE/NVD).