CVE-2026-13245 affects MaxButtons through version 9.8.5 and allows an unauthenticated attacker to inject an event handler into the admin list screen through the view query parameter. An administrator who opens a crafted URL and activates the injected access key can run JavaScript within their wp-admin session. This can expose administrative data or allow actions available to the victim account. The issue is fixed in version 9.8.6.
| CVE | CVE-2026-13245 |
| Plugin Version | MaxButtons <= 9.8.5, fixed in 9.8.6 |
| All Time | 5 220 673 |
| Active installations | 70 000+ |
| Publicly Published | June 26, 2026 |
| Last Updated | June 27, 2026 |
| Researcher | Dmitrii Ignatyev |
| CWE | CWE-79 |
| PoC | Yes |
| Exploit | No |
| Reference | https://www.cve.org/CVERecord?id=CVE-2026-13245 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/maxbuttons/maxbuttons-985-reflected-cross-site-scripting-via-view-parameter |
| Plugin Security Certification by CleanTalk |  |
| Logo of the plugin |  |
PSC by CleantalkJoin the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.
Timeline
| May 04, 2026 | Plugin testing and vulnerability detection in MaxButtons were completed. |
| May 04, 2026 | The vulnerability report was sent with the PoC, description, and recommendations for remediation. |
| June 26, 2026 | CVE-2026-13245 was publicly disclosed by Wordfence. |
| June 27, 2026 | The public CVE-2026-13245 record was published. |
Discovery of the Vulnerability
The affected screen is reached at /wp-admin/admin.php?page=maxbuttons-controller. In classes/controllers/listController.php, loadView() reads $_GET["view"] and passes it through sanitize_text_field(). The resulting value reaches includes/maxbuttons-list.php, where it is printed inside the double-quoted value attribute of a hidden input without esc_attr().
PHP decodes the URL-encoded query value before the plugin reads it from $_GET. The encoded quote %22 therefore becomes a literal double quote, and text sanitization does not escape it for an HTML attribute. That quote closes the input value and allows the supplied accesskey and onclick attributes to become part of the element. This happens during the initial page render. The controller checks the form nonce in handlePost(), but that check does not protect the GET rendering path.
Understanding of Reflected Cross-Site Scripting attacks
Reflected Cross-Site Scripting occurs when data from a request is returned to the browser in an executable context. Here, the payload travels in the URL and is reflected into the admin response. It does not need to be stored in a button, post, or plugin setting. A hidden form input still needs correct output escaping because the browser parses its attributes.
The attacker does not need a WordPress account to construct the link. The victim must be logged in and able to access the MaxButtons screen. In the supplied PoC, script execution also requires activating the injected access key. Once triggered, the script runs in the site origin with the victim session and may issue administrative requests permitted by that account. Changes to settings, users, plugins, or themes depend on the victim capabilities and site configuration.
Exploiting the Reflected Cross-Site Scripting Vulnerability
The following PoC uses the supplied localhost URL and an alert to demonstrate execution. Open the link in the administrator session on a test installation. The attacker-controlled URL does not contain a nonce.
POC:
POC: 1. Use a local WordPress test installation with MaxButtons 9.8.5 installed and active. 2. Log in as an administrator who can open the MaxButtons list screen. 3. Open the following URL in that authenticated browser session: http://127.0.0.1/wordpress/wp-admin/admin.php?page=maxbuttons-controller&view=%22+accesskey%3DX+onclick%3Dalert%281%29+x%3D%22 4. Press Alt + Shift + X to activate the injected access key. 5. Observe the alert displaying 1.____
The expected result is an alert containing 1 when the injected click handler is activated. Loading the page reflects the attributes, but the supplied payload is triggered by the keyboard action. Access-key combinations vary by browser and operating system, so the stated Alt + Shift + X sequence applies where that combination activates access key X.
Recommendations for Improved Security
Update MaxButtons to version 9.8.6 or later. The 9.8.6 template applies esc_attr() to the hidden input value, closing the reported attribute-injection path. If an update cannot be applied immediately, administrators should avoid untrusted links to the plugin screen and consider temporarily deactivating the affected plugin.
Developers should restrict the view parameter to the supported list states and escape every dynamic HTML attribute at the point of output. WordPress provides esc_attr() for this context. Keep capability and nonce checks for actions that change data, and check the initial GET render separately when reviewing admin forms.
Correcting the output handling behind CVE-2026-13245 keeps a list-view parameter from becoming executable markup in an administrator browser. Applying the patched MaxButtons release closes this reported path.
#WordPressSecurity #ReflectedXSS #MaxButtons #PluginSecurity #WebsiteSafety #StayProtected
Use CleanTalk solutions to improve the security of your website
