CVE-2014-125092 (PHP, published 2023-03-05T21:15Z)
Description: value: A vulnerability was found in MaxButtons Plugin up to 1.26.0 on WordPress and classified as problematic. This issue affects the function maxbuttons_strip_px of the file includes/maxbuttons-button.php. The manipulation of the argument button_id leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.26.1 is able to address this issue. The patch is named e74564c9e3b7429808e317f4916bd1c26ef0b806. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-222323.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wp-plugins/maxbuttons
Files changed:
includes/maxbuttons-button.php
maxbuttons.php
readme.txt
Commit message: 1.26.1 Updates. XSS Vulnerability fixed.

git-svn-id: https://plugins.svn.wordpress.org/maxbuttons/trunk@1000617 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
if (isset($_GET['id']) && $_GET['id'] != '') {
}
	<?php } ?>
Version: 1.26.0
	define('MAXBUTTONS_VERSION_NUM', '1.26.0');
Stable tag: 1.26.0
* [How to Create WordPress Buttons?](http://www.maxbuttons.com/#CSS3/?utm_source=wordpress&utm_medium=mbrepo&utm_content=how-to-create&utm_campaign=plugin) 
* [How to make a WordPress Buttons?](http://www.maxbuttons.com/?utm_source=wordpress&utm_medium=mbrepo&utm_content=how-to-make&utm_campaign=plugin) 
* [What is a WordPress Button Generator?](http://maxbuttons.com/tour/button-editor/?utm_source=wordpress&utm_medium=mbrepo&utm_content=what-is-generator&utm_campaign=plugin)
* [How do I see my WordPress Buttons?](http://maxbuttons.com/tour/button-list/?utm_source=wordpress&utm_medium=mbrepo&utm_content=how-to-see&utm_campaign=plugin)
* [What's the best way to use Font Awesome with Wordpress?](http://www.maxbuttons.com/?utm_source=wordpress&utm_medium=mbrepo&utm_content=font-awesome&utm_campaign=plugin)
* [How do Button Pack libraries make me and my firm more effective?](http://www.maxbuttons.com/shop/category/button-packs/?utm_source=wordpress&utm_medium=mbrepo&utm_content=how-to-create&utm_campaign=plugin)
Take your buttons to the next level with [MaxButtons Pro](http://www.maxbuttons.com/pricing/?utm_source=wordpress&utm_medium=mbrepo&utm_content=MBPro&utm_campaign=plugin), which gives you additional features such as:
And the best part is that you can get this awesome [CSS3 button generator](http://www.maxbuttons.com/?utm_source=wordpress&utm_medium=mbrepo&utm_content=CSS3&utm_campaign=plugin) for **only $19!**

Fixed code:
if (isset($_GET['id']) && $_GET['id'] != '' && intval($_GET['id']) != 0) {
} elseif(isset($_GET['id'])) {
	die();
} else {}
		<?php if(intval($button_id != 0)) { ?>
	<?php } else {
		die();
	} } ?>
Version: 1.26.1
	define('MAXBUTTONS_VERSION_NUM', '1.26.1');
Stable tag: 1.26.1
* [How to Create WordPress Buttons?](http://www.maxbuttons.com/#CSS3/?utm_source=wordpress&utm_medium=mbrepo&utm_content=how-to-create&utm_campaign=repo) 
* [How to make a WordPress Buttons?](http://www.maxbuttons.com/?utm_source=wordpress&utm_medium=mbrepo&utm_content=how-to-make&utm_campaign=repo) 
* [What is a WordPress Button Generator?](http://maxbuttons.com/tour/button-editor/?utm_source=wordpress&utm_medium=mbrepo&utm_content=what-is-generator&utm_campaign=repo)
* [How do I see my WordPress Buttons?](http://maxbuttons.com/tour/button-list/?utm_source=wordpress&utm_medium=mbrepo&utm_content=how-to-see&utm_campaign=repo)
* [What's the best way to use Font Awesome with Wordpress?](http://www.maxbuttons.com/?utm_source=wordpress&utm_medium=mbrepo&utm_content=font-awesome&utm_campaign=repo)
* [How do Button Pack libraries make me and my firm more effective?](http://www.maxbuttons.com/shop/category/button-packs/?utm_source=wordpress&utm_medium=mbrepo&utm_content=how-to-create&utm_campaign=repo)
Take your buttons to the next level with [MaxButtons Pro](http://www.maxbuttons.com/pricing/?utm_source=wordpress&utm_medium=mbrepo&utm_content=MBPro&utm_campaign=repo), which gives you additional features such as:
And the best part is that you can get this awesome [CSS3 button generator](http://www.maxbuttons.com/?utm_source=wordpress&utm_medium=mbrepo&utm_content=CSS3&utm_campaign=repo) for **only $19!**
= 1.26.1 =
* Fixed an XSS vulnerability on the button creation page