CVE-2026-13245: MaxButtons WordPress Plugin XSS Flaw

CVE-2026-13245 Overview

CVE-2026-13245 is a Reflected Cross-Site Scripting (XSS) vulnerability in the MaxButtons – Create buttons plugin for WordPress. The flaw affects all versions up to and including 9.8.5. The view parameter fails to sanitize input and escape output, allowing unauthenticated attackers to inject arbitrary JavaScript into rendered pages. Successful exploitation requires user interaction, typically clicking a crafted link. The vulnerability is tracked as CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Unauthenticated attackers can execute arbitrary scripts in a victim's browser session, enabling session theft, administrative account takeover, and defacement when a logged-in administrator clicks a malicious link.

Affected Products

MaxButtons – Create buttons plugin for WordPress, all versions ≤ 9.8.5
WordPress sites with the MaxButtons plugin installed and activated
Administrative interfaces exposing the view parameter through the plugin's list controller

Discovery Timeline

2026-06-27 - CVE-2026-13245 published to the National Vulnerability Database
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-13245

Vulnerability Analysis

The vulnerability stems from insufficient input sanitization and output escaping on the view parameter processed by the MaxButtons plugin. The affected code paths reside in classes/controllers/listController.php and includes/maxbuttons-list.php, where the view parameter is read from the HTTP request and reflected into the response without proper encoding.

Because the payload reflects back into the rendered page, an attacker-controlled string containing HTML or JavaScript executes in the context of the vulnerable site's origin. Attackers do not need authentication to deliver the payload, but they require a victim to trigger the crafted URL. When a WordPress administrator is the target, the resulting script executes with the administrator's session cookies accessible to same-origin JavaScript.

Root Cause

The plugin reads the view parameter from user-controlled request data and passes it directly into an HTML rendering context without applying WordPress escaping functions such as esc_attr() or esc_html(). This omission allows raw markup to be inserted into the DOM. The vendor addressed the issue in changeset 3586921, published in the plugin's Trac repository.

Attack Vector

The attack requires network access to the vulnerable WordPress site and user interaction. An attacker crafts a URL containing a malicious payload in the view query parameter and delivers it via phishing, forum posts, or malicious advertising. When the target user, ideally an authenticated administrator, opens the link, the plugin reflects the payload into the response. The injected script executes under the site's origin, allowing session token theft, forced administrative actions via the WordPress REST API, or plugin-based backdoor installation.

For technical details, refer to the Wordfence Vulnerability Report and the WordPress MaxButtons Controller source.

Detection Methods for CVE-2026-13245

Indicators of Compromise

HTTP requests to WordPress admin URLs containing suspicious view parameter values with HTML tags, javascript: schemes, or event handlers such as onerror= and onload=
Web server access logs showing URL-encoded <script>, <img>, or <svg> payloads in the view query string
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after clicking external links
Newly created WordPress administrator accounts or modified plugin files without a corresponding legitimate change record

Detection Strategies

Inspect web application firewall logs for requests targeting MaxButtons endpoints with encoded angle brackets or script keywords in the view parameter
Correlate administrator authentication events with subsequent unusual REST API calls originating from the same session
Monitor for changes to WordPress user roles, plugin files, and theme files following any inbound click-through from external referrers

Monitoring Recommendations

Enable and review WordPress audit logs for administrative actions performed outside normal working hours
Deploy Content Security Policy (CSP) headers in report-only mode to identify inline script execution attempts in the admin dashboard
Alert on referrer patterns where WordPress admin pages are loaded from external, non-corporate domains

How to Mitigate CVE-2026-13245

Immediate Actions Required

Update the MaxButtons plugin to a version later than 9.8.5 that incorporates changeset 3586921
Audit WordPress administrator accounts for unexpected additions or permission changes
Force password resets and invalidate active sessions for all administrative users on affected sites
Restrict access to the WordPress admin interface using IP allowlisting or VPN gating where feasible

Patch Information

The vendor released a fix documented in the WordPress MaxButtons Changeset on the WordPress Plugin Trac. Site operators should upgrade to the latest release available through the WordPress Plugin Directory. Verify the installed version in the WordPress admin dashboard under Plugins after applying the update.

Workarounds

Deactivate and remove the MaxButtons plugin until the patched release is applied
Deploy a web application firewall rule that blocks requests containing HTML tags or javascript: schemes in the view parameter
Train administrators to avoid clicking external links that redirect to their own WordPress admin URLs
Implement a strict Content Security Policy that disallows inline scripts in the WordPress admin interface

bash

# Example WAF rule (ModSecurity) blocking script payloads in the 'view' parameter
SecRule ARGS:view "@rx (?i)(<script|javascript:|onerror=|onload=|<svg|<img[^>]+src=)" \
    "id:1013245,phase:2,deny,status:403,\
    msg:'CVE-2026-13245 MaxButtons Reflected XSS attempt',\
    tag:'CWE-79'"