Search criteria

3 vulnerabilities found for maxbuttons by maxbuttons_project

FKIE_CVE-2017-2169

Vulnerability from fkie_nvd - Published: 2017-05-22 16:29 - Updated: 2025-04-20 01:37
Severity ?
6.1 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Cross-site scripting vulnerability in MaxButtons prior to version 6.19 and MaxButtons Pro prior to version 6.19 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
vultures@jpcert.or.jphttp://jvndb.jvn.jp/jvndb/JVNDB-2017-000093Third Party Advisory, VDB Entry
vultures@jpcert.or.jphttps://jvn.jp/en/jp/JVN70411623/index.htmlThird Party Advisory, VDB Entry
vultures@jpcert.or.jphttps://wordpress.org/plugins/maxbuttons/#developersRelease Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://jvndb.jvn.jp/jvndb/JVNDB-2017-000093Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://jvn.jp/en/jp/JVN70411623/index.htmlThird Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://wordpress.org/plugins/maxbuttons/#developersRelease Notes, Vendor Advisory
Impacted products
Vendor Product Version
maxbuttons_project maxbuttons *
maxbuttons_project maxbuttons *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:maxbuttons_project:maxbuttons:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "C1811FCD-1278-4FD1-A6F9-B930E3BB81AD",
              "versionEndIncluding": "6.18",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:maxbuttons_project:maxbuttons:*:*:*:*:pro:wordpress:*:*",
              "matchCriteriaId": "286CFE84-36CA-4917-AF14-80B3FF798B1E",
              "versionEndIncluding": "6.18",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting vulnerability in MaxButtons prior to version 6.19 and MaxButtons Pro prior to version 6.19 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad Cross-Site Scripting (XSS) en versiones anteriores a la 6.19 de MaxButtons y hasta la 6.19 de MaxButtons Pro permite a atacantes remotos inyectar scripts web o HTML arbitrarios utilizando vectores no especificados."
    }
  ],
  "id": "CVE-2017-2169",
  "lastModified": "2025-04-20T01:37:25.860",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-05-22T16:29:00.700",
  "references": [
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2017-000093"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://jvn.jp/en/jp/JVN70411623/index.html"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "url": "https://wordpress.org/plugins/maxbuttons/#developers"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2017-000093"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://jvn.jp/en/jp/JVN70411623/index.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "url": "https://wordpress.org/plugins/maxbuttons/#developers"
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2017-2169 (GCVE-0-2017-2169)

Vulnerability from cvelistv5 – Published: 2017-05-22 16:00 – Updated: 2024-08-05 13:48
VLAI?
Summary
Cross-site scripting vulnerability in MaxButtons prior to version 6.19 and MaxButtons Pro prior to version 6.19 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity ?
No CVSS data available.
CWE
  • Cross-site scripting
Assigner
References
https://wordpress.org/plugins/maxbuttons/#developers x_refsource_CONFIRM
https://jvn.jp/en/jp/JVN70411623/index.html third-party-advisoryx_refsource_JVN
http://jvndb.jvn.jp/jvndb/JVNDB-2017-000093 third-party-advisoryx_refsource_JVNDB
Impacted products
Vendor Product Version
Max Foundry MaxButtons Affected: prior to version 6.19
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T13:48:03.667Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://wordpress.org/plugins/maxbuttons/#developers"
          },
          {
            "name": "JVN#70411623",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN70411623/index.html"
          },
          {
            "name": "JVNDB-2017-000093",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVNDB",
              "x_transferred"
            ],
            "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2017-000093"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MaxButtons",
          "vendor": "Max Foundry",
          "versions": [
            {
              "status": "affected",
              "version": "prior to version 6.19"
            }
          ]
        },
        {
          "product": "MaxButtons Pro",
          "vendor": "Max Foundry",
          "versions": [
            {
              "status": "affected",
              "version": "prior to version 6.19"
            }
          ]
        }
      ],
      "datePublic": "2017-05-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting vulnerability in MaxButtons prior to version 6.19 and MaxButtons Pro prior to version 6.19 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-05-22T15:57:01",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://wordpress.org/plugins/maxbuttons/#developers"
        },
        {
          "name": "JVN#70411623",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "https://jvn.jp/en/jp/JVN70411623/index.html"
        },
        {
          "name": "JVNDB-2017-000093",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVNDB"
          ],
          "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2017-000093"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2017-2169",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "MaxButtons",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "prior to version 6.19"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "MaxButtons Pro",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "prior to version 6.19"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Max Foundry"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting vulnerability in MaxButtons prior to version 6.19 and MaxButtons Pro prior to version 6.19 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wordpress.org/plugins/maxbuttons/#developers",
              "refsource": "CONFIRM",
              "url": "https://wordpress.org/plugins/maxbuttons/#developers"
            },
            {
              "name": "JVN#70411623",
              "refsource": "JVN",
              "url": "https://jvn.jp/en/jp/JVN70411623/index.html"
            },
            {
              "name": "JVNDB-2017-000093",
              "refsource": "JVNDB",
              "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2017-000093"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2017-2169",
    "datePublished": "2017-05-22T16:00:00",
    "dateReserved": "2016-12-01T00:00:00",
    "dateUpdated": "2024-08-05T13:48:03.667Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-2169 (GCVE-0-2017-2169)

Vulnerability from nvd – Published: 2017-05-22 16:00 – Updated: 2024-08-05 13:48
VLAI?
Summary
Cross-site scripting vulnerability in MaxButtons prior to version 6.19 and MaxButtons Pro prior to version 6.19 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity ?
No CVSS data available.
CWE
  • Cross-site scripting
Assigner
References
https://wordpress.org/plugins/maxbuttons/#developers x_refsource_CONFIRM
https://jvn.jp/en/jp/JVN70411623/index.html third-party-advisoryx_refsource_JVN
http://jvndb.jvn.jp/jvndb/JVNDB-2017-000093 third-party-advisoryx_refsource_JVNDB
Impacted products
Vendor Product Version
Max Foundry MaxButtons Affected: prior to version 6.19
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T13:48:03.667Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://wordpress.org/plugins/maxbuttons/#developers"
          },
          {
            "name": "JVN#70411623",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN70411623/index.html"
          },
          {
            "name": "JVNDB-2017-000093",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVNDB",
              "x_transferred"
            ],
            "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2017-000093"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MaxButtons",
          "vendor": "Max Foundry",
          "versions": [
            {
              "status": "affected",
              "version": "prior to version 6.19"
            }
          ]
        },
        {
          "product": "MaxButtons Pro",
          "vendor": "Max Foundry",
          "versions": [
            {
              "status": "affected",
              "version": "prior to version 6.19"
            }
          ]
        }
      ],
      "datePublic": "2017-05-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting vulnerability in MaxButtons prior to version 6.19 and MaxButtons Pro prior to version 6.19 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-05-22T15:57:01",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://wordpress.org/plugins/maxbuttons/#developers"
        },
        {
          "name": "JVN#70411623",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "https://jvn.jp/en/jp/JVN70411623/index.html"
        },
        {
          "name": "JVNDB-2017-000093",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVNDB"
          ],
          "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2017-000093"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2017-2169",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "MaxButtons",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "prior to version 6.19"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "MaxButtons Pro",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "prior to version 6.19"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Max Foundry"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting vulnerability in MaxButtons prior to version 6.19 and MaxButtons Pro prior to version 6.19 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wordpress.org/plugins/maxbuttons/#developers",
              "refsource": "CONFIRM",
              "url": "https://wordpress.org/plugins/maxbuttons/#developers"
            },
            {
              "name": "JVN#70411623",
              "refsource": "JVN",
              "url": "https://jvn.jp/en/jp/JVN70411623/index.html"
            },
            {
              "name": "JVNDB-2017-000093",
              "refsource": "JVNDB",
              "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2017-000093"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2017-2169",
    "datePublished": "2017-05-22T16:00:00",
    "dateReserved": "2016-12-01T00:00:00",
    "dateUpdated": "2024-08-05T13:48:03.667Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}