Max Foundry vulnerabilities

Products

• Media Library Folders 2
• MaxButtons 1
• MaxButtons (WordPress plugin) 1
• MaxButtons Pro 1
• MaxGalleria (WordPress plugin) 1
• Media Library Folders (WordPress plugin) 1
• WordPress Button Plugin MaxButtons 1
• WordPress Button Plugin MaxButtons (WordPress plugin) 1

Latest Max Foundry CVEs

Newest publication first

1. CVE-2024-31287 WordPress Media Library Folders plugin <= 8.1.8 - Directory Traversal vulnerability

   Published 2024-04-10

   Medium·CVSS 6.5

   Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Max Foundry Media Library Folders.This issue affects Media Library Folders: from n/a through 8.1.8.

2. CVE-2024-30486 WordPress Media Library Folders plugin <= 8.1.7 - Auth. SQL Injection vulnerability

   Published 2024-03-29

   High·CVSS 8.8

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Max Foundry Media Library Folders.This issue affects Media Library Folders: from n/a through 8.1.7.

3. CVE-2023-36503 WordPress MaxButtons Plugin <= 9.5.3 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-07-25

   Medium·CVSS 5.4

   Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Max Foundry WordPress Button Plugin MaxButtons plugin <= 9.5.3 versions.

4. CVE-2022-41634 WordPress Media Library Folders plugin <= 7.1.1 - Cross-Site Request Forgery (CSRF) vulnerability

   Published 2022-11-18

   High·CVSS 8.8

   Cross-Site Request Forgery (CSRF) vulnerability in Media Library Folders plugin <= 7.1.1 on WordPress.

5. CVE-2022-38703 WordPress Button Plugin MaxButtons plugin <= 9.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

   Published 2022-09-23

   Medium·CVSS 4.8

   Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Max Foundry Button Plugin MaxButtons plugin <= 9.2 at WordPress

6. CVE-2022-36346 WordPress MaxButtons plugin <= 9.2 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

   Published 2022-08-22

   High·CVSS 8.8

   Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Max Foundry MaxButtons plugin <= 9.2 at WordPress.

7. CVE-2022-25603 WordPress MaxGalleria plugin <= 6.2.5 - Stored Cross-Site Scripting (XSS) vulnerability

   Published 2022-03-18

   Medium·CVSS 4.8

   Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability discovered in MaxGalleria WordPress plugin (versions 6.2.5).

8. CVE-2017-2169 Cross-site scripting vulnerability in MaxButtons prior to version 6.19 and MaxButtons Pro prior to version 6.19 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

   Published 2017-05-22

   Medium·CVSS 6.1

   Cross-site scripting vulnerability in MaxButtons prior to version 6.19 and MaxButtons Pro prior to version 6.19 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.