CVE-2023-6594: 
WordPress vulnerability analysis and mitigation

The WordPress Button Plugin MaxButtons is affected by a Stored Cross-Site Scripting vulnerability (CVE-2023-6594) in all versions up to and including 9.7.4. The vulnerability was discovered and disclosed on January 8, 2024, affecting the admin settings functionality of the plugin (NVD).

The vulnerability stems from insufficient input sanitization and output escaping in the admin settings. This security flaw has been assigned a CVSS v3.1 base score of 4.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

The vulnerability only affects multi-site installations and installations where unfiltered_html has been disabled. When exploited, it allows authenticated attackers with administrator-level permissions to inject arbitrary web scripts that execute when users access the affected pages. Additionally, administrators can grant button creation privileges to lower-privileged users (contributor+), potentially enabling these users to conduct attacks (NVD).

The vulnerability requires an authenticated attacker with administrator-level permissions or higher to exploit. The attack complexity is considered low, but requires user interaction for successful exploitation (NVD).

Users are advised to update their MaxButtons plugin to a version newer than 9.7.4 to address this vulnerability. A patch has been made available through the WordPress plugin repository (WordPress Patch).