CVE-2026-13245: MaxButtons Reflected XSS Vulnerability in WordPress Plugin

Technical summary

CVE-2026-13245 is a reflected XSS vulnerability (CWE-79) in the MaxButtons plugin affecting all versions through 9.8.5. The vulnerability exists in the 'view' parameter, which is not properly sanitized before being reflected in HTTP responses. An unauthenticated attacker can inject arbitrary JavaScript that executes in a victim's browser session. The attack vector is network-based with low complexity; the primary barrier to exploitation is user interaction—the target must follow a malicious link. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) reflects a score of 6.1 (MEDIUM severity), with impact limited to confidentiality and integrity within the scope of the affected page or session.

Business impact

This vulnerability could allow attackers to compromise user sessions on WordPress sites running the MaxButtons plugin. Potential impacts include unauthorized changes to published content, theft of admin credentials if administrators click a malicious link, defacement of pages, or injection of malware or phishing content visible to site visitors. The scope changes from the plugin to the broader application context (S:C in CVSS), meaning an attacker could potentially affect other users or the site's reputation. For sites with high traffic or sensitive functionality, even a temporary XSS injection can undermine user trust and require incident response efforts.

Affected systems

Any WordPress installation running the MaxButtons – Create buttons plugin in version 9.8.5 or earlier is vulnerable. This includes sites using the plugin for creating custom call-to-action buttons, navigation elements, or interactive components. The vulnerability is not inherent to WordPress core; it is specific to this third-party plugin. Exposure depends on plugin adoption and whether affected versions remain deployed after patches are released.

Exploitability

This is a reflected XSS vulnerability with relatively low exploitation barriers from a technical perspective. An attacker needs only to craft a URL containing the malicious payload in the 'view' parameter and convince a user (via email, chat, social media, etc.) to click it. No authentication is required, and no server-side interaction is needed beyond returning the unsanitized parameter. However, the attack does require user interaction (UI:R), which is why the CVSS score remains MEDIUM rather than HIGH. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild is either not yet observed or not yet confirmed at scale.

Remediation

The primary remediation is to update the MaxButtons plugin to a patched version released after June 27, 2026. Site administrators should check the plugin's changelog and security advisories to identify which version number contains the fix. If an update is available, apply it immediately to all affected WordPress installations. If a patched version is not yet available at the time of discovery, disable the plugin temporarily until a secure version is released, or restrict its use to trusted users only. Additionally, review access logs for any suspicious 'view' parameter values that may indicate exploitation attempts.

Patch guidance

WordPress site administrators should navigate to Plugins > Installed Plugins in the WordPress dashboard and check MaxButtons for available updates. If an update is available, click 'Update Now.' Verify against the plugin vendor's official advisory or changelog to confirm the update version resolves CVE-2026-13245. After patching, test the plugin's functionality to ensure no regressions. For automated management, enable automatic plugin updates if your hosting environment and plugin compatibility policies permit. If no patched version is available, consider disabling the plugin via the Plugins dashboard until the vendor releases a fix.

Detection guidance

Monitor web server access logs for requests containing suspicious characters or script tags in the 'view' parameter of URLs related to the MaxButtons plugin. Look for patterns such as encoded JavaScript (e.g., %3Cscript%3E) or event handlers (e.g., onerror=, onclick=). Implement a Web Application Firewall (WAF) rule to block requests with script-like content in this parameter. Use WordPress security plugins (e.g., Wordfence, Sucuri) to scan for indicators of XSS exploitation, such as injected malicious content in post or page metadata. Monitor user session anomalies if an attack succeeds, such as unexpected password changes or unauthorized post modifications.

Why prioritize this

While the CVSS score is MEDIUM (6.1), this vulnerability merits prompt attention because: (1) it affects a plugin that is likely installed on many WordPress sites for UI customization; (2) exploitation requires no authentication and low technical complexity; (3) the attack scope extends beyond the plugin itself; and (4) if exploited, it could allow attackers to modify site content or harvest admin credentials. Organizations running this plugin should prioritize patching within their standard update cycles for medium-severity issues, ideally within 1–2 weeks of patch availability.

Risk score, explained

The CVSS 3.1 score of 6.1 (MEDIUM) reflects the following: Network-based attack vector (AV:N) with low complexity (AC:L) and no privilege requirement (PR:N) indicate ease of attack setup. However, user interaction (UI:R) is required, reducing the likelihood of automated or widespread exploitation. The attack impact is limited to low confidentiality and integrity loss (C:L, I:L) with no availability impact (A:N), and the scope changes (S:C), meaning the vulnerability can affect resources beyond its security scope. This combination yields a MEDIUM severity rating appropriate for a reflected XSS that requires social engineering but could compromise site integrity and user trust.

Frequently asked questions