PLUGIN SECURITY
Is Maxbuttons safe?
Maxbuttons is the best and easiest button plugin for WordPress. Within minutes you can create beautiful buttons, share buttons and social icons.
What this plugin does
- Slug:
maxbuttons - Author: maxfoundry
- 70000+ active installs
- 98/100 rating (1093 reviews on wordpress.org)
- 5215789 all-time downloads
- On WordPress.org since 2011-08-16
butotn creatorcss wordpress buttoncss3 button generatorresponsive buttonsshare button
Maintenance status
- Latest known version: 9.8.6
- Last updated: 2026-06-26 8:02am GMT
- Tested up to WordPress: 7.0.4
- Requires PHP: 7.0+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
14 known CVEs on file for Maxbuttons.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-13245 | MaxButtons – Create buttons [maxbuttons] < 9.8.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 9.8.6 | 9.8.6 | 2026-06-26 | ✓ fixed in latest |
| CVE-2025-39444 | MaxButtons – Create buttons [maxbuttons] < 9.8.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.9 | < 9.8.4 | 9.8.4 | 2025-04-17 | ✓ fixed in latest |
| CVE-2024-10555 | MaxButtons – Create buttons [maxbuttons] < 9.8.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 9.8.1 | 9.8.1 | 2024-11-29 | ✓ fixed in latest |
| CVE-2024-6499 | MaxButtons – Create buttons [maxbuttons] < 9.8.0 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 5.3 | < 9.8.0 | 9.8.0 | 2024-08-23 | ✓ fixed in latest |
| CVE-2024-3026 | MaxButtons – Create buttons [maxbuttons] < 9.7.8 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 9.7.8 | 9.7.8 | 2024-06-22 | ✓ fixed in latest |
| CVE-2023-7029 | MaxButtons – Create buttons [maxbuttons] < 9.7.7 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 9.7.7 | 9.7.7 | 2024-01-23 | ✓ fixed in latest |
| CVE-2023-6594 | MaxButtons – Create buttons [maxbuttons] < 9.7.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 9.7.6 | 9.7.6 | 2024-01-08 | ✓ fixed in latest |
| CVE-2023-36503 | MaxButtons – Create buttons [maxbuttons] < 9.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 9.6 | 9.6 | 2023-06-23 | ✓ fixed in latest |
+ 10 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2014-125092 | MaxButtons – Create buttons [maxbuttons] < 1.26.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.26.1 | 1.26.1 | 2023-03-05 | ✓ fixed in latest |
| CVE-2022-36346 | MaxButtons – Create buttons [maxbuttons] < 9.3 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 9.3 | 9.3 | 2022-08-02 | ✓ fixed in latest |
| CVE-2022-38703 | MaxButtons – Create buttons [maxbuttons] < 9.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Low 3.4 | < 9.3 | 9.3 | 2022-07-29 | ✓ fixed in latest |
| CVE-2017-2169 | MaxButtons – Create buttons [maxbuttons] < 6.19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 6.19 | 6.19 | 2017-05-16 | ✓ fixed in latest |
| CVE-2014-7181 | MaxButtons – Create buttons [maxbuttons] < 1.26.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 1.26.1 | 1.26.1 | 2014-09-24 | ✓ fixed in latest |
| — | MaxButtons – Create buttons [maxbuttons] < 1.20.0 | — | Unknown | < 1.20.0 | 1.20.0 | 2014-08-01 | ✓ fixed in latest |
| — | MaxButtons – Create buttons [maxbuttons] < 9.8.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.7 | < 9.8.1 | 9.8.1 | 0000-00-00 | ✓ fixed in latest |
| — | MaxButtons – Create buttons [maxbuttons] < 1.20.0 | — | Unknown | < 1.20.0 | 1.20.0 | — | ✓ fixed in latest |
| — | MaxButtons 1.19.0 - includes/maxbuttons-button-css.php Authentication Bypass | — | Unknown | < 1.20.0 | 1.20.0 | — | ✓ fixed in latest |
| CVE-2024-8968 | MaxButtons < 9.8.1 - Admin+ Stored XSS via Text Color | — | Unknown | < 9.8.1 | 9.8.1 | — | ✓ fixed in latest |
How to fix it
Keep Maxbuttons updated — 9.8.6 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.