CVE-2024-10555

Summary

CVE-2024-10555 is a vulnerability affecting the MaxButtons plugin for WordPress. This issue allows high privilege users, including admins, to execute stored Cross-Site Scripting (XSS) attacks, despite the unfiltered_html capability being disabled. The plugin fails to properly sanitize and escape certain settings, making it possible for attackers to inject malicious scripts that can compromise the security of the WordPress site. This vulnerability poses a significant risk, especially in multisite setups, and requires users to update to the latest version of the plugin (9.8.1) as soon as possible to mitigate the threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.