CVE-2024-10555: MaxButtons < 9.8.1 - Admin+ Stored XSS via Button Width
The WordPress Button Plugin MaxButtons WordPress plugin before 9.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10555?
CVE-2024-10555 is classified as a high severity vulnerability due to its potential to allow Stored Cross-Site Scripting attacks.
How do I fix CVE-2024-10555?
To fix CVE-2024-10555, update the MaxButtons WordPress plugin to version 9.8.1 or later.
What impact does CVE-2024-10555 have on my WordPress site?
CVE-2024-10555 can allow high privilege users to inject malicious scripts that execute on the browsers of users visiting your WordPress site.
Who is affected by CVE-2024-10555?
CVE-2024-10555 affects users of the MaxButtons WordPress plugin prior to version 9.8.1.
Is CVE-2024-10555 related to Cross-Site Scripting?
Yes, CVE-2024-10555 involves Stored Cross-Site Scripting vulnerabilities due to improper sanitization and escaping of plugin settings.