CVE-2024-3026: WordPress Button Plugin MaxButtons < 9.7.8 - Editor+ Stored XSS
Published Jul 13, 2024
·Updated
The WordPress Button Plugin MaxButtons WordPress plugin before 9.7.8 does not sanitise and escape some parameters, which could allow users with a role as low as editor to perform Cross-Site Scripting attacks
Affected Software
2 affected components
WordPress MaxButtons<9.7.8
Maxfoundry Maxbuttons Wordpress<9.7.8
Event History
Jul 13, 2024
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2024-3026?
CVE-2024-3026 has a medium severity rating due to its potential for Cross-Site Scripting attacks.
2
How do I fix CVE-2024-3026?
To fix CVE-2024-3026, update the MaxButtons WordPress plugin to version 9.7.8 or later.
3
Who is affected by CVE-2024-3026?
Users with the editor role or higher on websites using MaxButtons plugin versions prior to 9.7.8 are affected by CVE-2024-3026.
4
What type of vulnerability is CVE-2024-3026?
CVE-2024-3026 is a Cross-Site Scripting (XSS) vulnerability.
5
Can CVE-2024-3026 be exploited remotely?
Yes, CVE-2024-3026 can be exploited remotely by an attacker with low-level user access.