CVE-2023-36503

MediumCVSS 6.5

Published: 25/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

24th percentile - higher than 24% of all known CVEs

Summary

The MaxButtons plugin versions up to 9.5.3 contain a Cross-Site Scripting (XSS) vulnerability for users with contributor permissions and above. An attacker can exploit this flaw to inject malicious JavaScript code.

Risk Assessment

Exploitation of this vulnerability may lead to session data theft and account takeover. This poses a threat to the overall security of the WordPress site.

Recommendation

It is recommended to update the MaxButtons plugin to the latest version to mitigate this vulnerability. A security audit of the site should also be conducted.

Original NVD description (English source)

Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Max Foundry WordPress Button Plugin MaxButtons plugin <= 9.5.3 versions.