Maxfoundry vulnerabilities

Products

• Maxbuttons 13
• Media Library Folders 7
• Media Library Folders 7
• Maxbuttons – Create Buttons 4
• Maxgalleria 4
• Wordpress Button Plugin Maxbuttons 4
• Social Share Buttons 3
• Wp-paginate 3

Newest

• maxfoundry social share buttons Social Share Buttons <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network Setting CVE-2026-100108 6.4 MediumOctober 16, 2026
• maxfoundry social share buttons WordPress Social Share Buttons plugin <= 1.31 - Cross Site Scripting (XSS) vulnerability CVE-2026-109702 7.1 HighOctober 15, 2026
• maxfoundry maxgalleria WordPress MaxGalleria plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability CVE-2026-97260 7.1 HighOctober 1, 2026
• maxfoundry maxbuttons – create buttons MaxButtons <= 9.8.5 - Reflected Cross-Site Scripting via 'view' Parameter CVE-2026-13245 6.1 MediumJune 27, 2026
• maxfoundry wp-paginate WordPress Plugin WP-Paginate 2.1.3 Stored XSS via preset CVE-2021-47982 5.1 MediumJune 8, 2026
• maxfoundry media library folders Media Library Folders <= 8.3.6 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Attachment Deletion and Rename CVE-2026-2312 4.3 MediumFebruary 14, 2026
• maxfoundry maxbuttons WordPress MaxButtons plugin <= 9.8.3 - Cross Site Scripting (XSS) vulnerability CVE-2025-39444 5.9 MediumApril 17, 2025
• maxfoundry maxa/b WordPress MaxA/B plugin <= 2.2.2 - CSRF to Stored XSS vulnerability CVE-2025-28933 7.1 HighMarch 11, 2025
• maxfoundry media library folders Media Library Folders <= 8.3.0 - Missing Authorization to Plugin Settings Change CVE-2025-0935 4.3 MediumFebruary 15, 2025
• maxfoundry maxbuttons, wordpress button plugin maxbuttons +1 more MaxButtons < 9.8.1 - Admin+ Stored XSS via Text Color CVE-2024-8968 4.7 MediumDecember 20, 2024
• maxfoundry maxbuttons, wordpress button plugin maxbuttons +1 more MaxButtons < 9.8.1 - Admin+ Stored XSS via Button Width CVE-2024-10555 4.8 MediumDecember 20, 2024
• maxfoundry social share buttons WordPress Social Share Buttons <= 1.19 - Reflected Cross-Site Scripting CVE-2024-9219 6.1 MediumOctober 19, 2024
• maxfoundry media library folders Media Library Folders <= 8.2.3 - Missing Authorization on Various Functions CVE-2024-7858 6.3 MediumAugust 30, 2024
• maxfoundry media library folders Media Library Folders <= 8.2.2 - Authenticated (Subscriber+) Second-Order SQL Injection CVE-2024-7857 6.5 MediumAugust 29, 2024
• maxfoundry maxbuttons, maxbuttons – create buttons +1 more WordPress Button Plugin MaxButtons <= 9.7.8 - Full Path Disclosure CVE-2024-6499 5.3 MediumAugust 24, 2024
• maxfoundry maxbuttons, wordpress button plugin maxbuttons +1 more WordPress Button Plugin MaxButtons < 9.7.8 - Editor+ Stored XSS CVE-2024-3026 5.4 MediumJuly 13, 2024
• maxfoundry maxgalleria MaxGalleria <= 6.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via maxgallery_thumb Shortcode CVE-2024-5970 6.4 MediumJune 18, 2024
• maxfoundry maxgalleria MaxGalleria <= 6.4.2 - Missing Authorization CVE-2024-3581 4.3 MediumMay 2, 2024
• maxfoundry media library folders Media Library Folders <= 8.2.0 - Reflected Cross-Site Scripting via 's' CVE-2024-3615 6.1 MediumApril 19, 2024
• max foundry media library folders WordPress Media Library Folders plugin <= 8.1.8 - Directory Traversal vulnerability CVE-2024-31287 6.5 MediumApril 10, 2024
• max foundry media library folders WordPress Media Library Folders plugin <= 8.1.7 - Auth. SQL Injection vulnerability CVE-2024-30486 8.5 HighMarch 29, 2024
• maxfoundry maxbuttons, maxbuttons – create buttons +1 more WordPress Button Plugin MaxButtons <= 9.7.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode CVE-2023-7029 6.4 MediumFebruary 5, 2024
• maxfoundry maxbuttons, maxbuttons – create buttons +1 more WordPress Button Plugin MaxButtons <= 9.7.4 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-6594 4.4 MediumJanuary 9, 2024
• max foundry wordpress button plugin maxbuttons, maxfoundry maxbuttons +1 more WordPress MaxButtons Plugin <= 9.5.3 is vulnerable to Cross Site Scripting (XSS) CVE-2023-36503 6.5 MediumJuly 25, 2023
• maxfoundry maxbuttons MaxButtons Plugin maxbuttons-button.php maxbuttons_strip_px cross site scripting CVE-2014-125092 3.5 LowMarch 5, 2023
• maxfoundry media library folders, max foundry media library folders (wordpress plugin) +1 more WordPress Media Library Folders plugin <= 7.1.1 - Cross-Site Request Forgery (CSRF) vulnerability CVE-2022-41634 5.4 MediumNovember 18, 2022
• maxfoundry maxbuttons, max foundry wordpress button plugin maxbuttons (wordpress plugin) +1 more WordPress Button Plugin MaxButtons plugin <= 9.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability CVE-2022-38703 3.4 LowSeptember 23, 2022
• maxfoundry maxbuttons, max foundry maxbuttons (wordpress plugin) +1 more WordPress MaxButtons plugin <= 9.2 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities CVE-2022-36346 4.3 MediumAugust 22, 2022
• maxfoundry wp-paginate WP Paginate < 2.1.9 - Admin+ Stored Cross-Site Scripting CVE-2022-2050 4.8 MediumJuly 11, 2022
• maxfoundry maxgalleria, max foundry maxgalleria (wordpress plugin) +1 more WordPress MaxGalleria plugin <= 6.2.5 - Stored Cross-Site Scripting (XSS) vulnerability CVE-2022-25603 4.8 MediumMarch 18, 2022
• maxfoundry wp-paginate WP Paginate < 2.1.4 - Admin+ Stored Cross-Site Scripting CVE-2021-4222 4.8 MediumFebruary 28, 2022
• max foundry maxbuttons, maxbuttons pro +1 more Cross-site scripting vulnerability in MaxButtons prior to version 6.19 and MaxButtons Pro prior... CVE-2017-2169 6.1 MediumMay 22, 2017
• maxfoundry maxbuttons Cross-site scripting (XSS) vulnerability in the Max Foundry MaxButtons plugin before 1.26.1 for... CVE-2014-7181 4.3 MediumOctober 16, 2014