Known vulnerabilities in MaxButtons – Create buttons

Maxbuttons is the best and easiest button plugin for WordPress. Within minutes you can create beautiful buttons, share buttons and social icons.

15Reported vulnerabilities

8.8Highest CVSS score

9.8.6Latest version

70,000+Active installs

What to do now

Update MaxButtons – Create buttons to 9.8.6 or later. 15 of these have a fixed version available. Updating resolves them.

Plugin last updated: June 26, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2024-3026	Medium 5.4	0.5%	Before 9.7.8	`9.7.8`	July 13, 2024
CVE-2014-7181	Medium 4.3	2.1%	Before 1.26.1	`1.26.1`	October 16, 2014
CVE-2024-10555	Medium 4.8	0.3%	Before 9.8.1	`9.8.1`	December 20, 2024
CVE-2022-36346	High 8.8	0.4%	9.2 and earlier	`9.3`	August 22, 2022
CVE-2024-8968	Medium 4.7	0.4%	Before 9.8.1	`9.8.1`	December 20, 2024
CVE-2017-2169	Medium 6.1	1.4%	6.18 and earlier	`6.19`	May 16, 2017
CVE-2014-125092	Medium 6.1	0.5%	Before 1.26.1	`1.26.1`	March 5, 2023
WF-41f6e826-9326-40fa-80d0-4cff1dd72536	Medium 6.4	—	9.2 and earlier	`9.3`	July 29, 2022
CVE-2026-13245	Medium 6.1	0.4%	0 to 9.8.5 (inclusive)	`9.8.6`	June 27, 2026
CVE-2023-7029	Medium 5.4	0.4%	Before 9.7.7	`9.7.7`	February 5, 2024
CVE-2023-36503	Medium 5.4	0.4%	9.5.3 and earlier	`9.6`	July 25, 2023
CVE-2024-6499	Medium 5.3	0.4%	Before 9.8.0	`9.8.0`	August 24, 2024
CVE-2023-6594	Medium 4.8	0.3%	9.7.4 and earlier	`9.7.6`	January 9, 2024
CVE-2022-38703	Medium 4.8	0.5%	9.2 and earlier	`9.3`	September 23, 2022
CVE-2025-39444	Medium 4.4	0.3%	9.8.3 and earlier	`9.8.4`	April 17, 2025

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.