PT-2024-15018 · WordPress · Maxbuttons

Rafshanzani Suhada

·

Published

2024-01-08

·

Updated

2024-01-11

·

CVE-2023-6594

CVSS v3.1

4.8

Medium

VectorAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions MaxButtons plugin for WordPress versions up to, and including, 9.7.4
Description The MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue affects multi-site installations and installations where unfiltered html has been disabled. Administrators can give button creation privileges to users with lower levels, such as contributor+, which would allow those lower-privileged users to carry out attacks.
Recommendations For MaxButtons plugin for WordPress versions up to, and including, 9.7.4, update to a version later than 9.7.4 to resolve the issue. As a temporary workaround, consider restricting the unfiltered html capability to prevent lower-privileged users from exploiting the vulnerability. Restrict access to the admin settings to minimize the risk of exploitation. Avoid giving button creation privileges to users with lower levels until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-6594

Affected Products

Maxbuttons