CVE-2025-39444: WordPress MaxButtons plugin <= 9.8.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maxfoundry MaxButtons allows Stored XSS.This issue affects MaxButtons: from n/a through 9.8.3.
Other sources
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxfoundry MaxButtons maxbuttons allows Stored XSS.This issue affects MaxButtons: from n/a through <= 9.8.3.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39444?
CVE-2025-39444 is classified as a high-severity vulnerability due to its potential for stored cross-site scripting (XSS) attacks.
How do I fix CVE-2025-39444?
To fix CVE-2025-39444, update the MaxButtons plugin to version 9.8.4 or later.
What are the potential impacts of CVE-2025-39444?
CVE-2025-39444 can allow attackers to inject malicious scripts into web pages, potentially compromising user data and session information.
Which versions of MaxButtons are affected by CVE-2025-39444?
CVE-2025-39444 affects all versions of MaxButtons from n/a through 9.8.3.
Who is the vendor for the MaxButtons vulnerability CVE-2025-39444?
The vendor for the MaxButtons vulnerability CVE-2025-39444 is MaxFoundry.