CVE-2026-13245

Name of the Vulnerable Software and Affected Versions MaxButtons – Create buttons plugin for WordPress versions prior to 9.8.6

Description Reflected Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages by tricking a user into clicking a malicious link. The issue is triggered via the view parameter.

Recommendations Update the plugin to version 9.8.6 or later. As a temporary mitigation, restrict or monitor the use of the view parameter.