Log in Start free

maxfoundry

Products

ProductCVEsExploitedLatest
Media Library Folders5–Feb 14, 2026
MaxButtons – Create buttons4–Jun 27, 2026
MaxGalleria3–Oct 1, 2026
Social Share Buttons3–Oct 16, 2026
MaxButtons1–Apr 17, 2025
WP-Paginate1–Jun 8, 2026
MaxA/B1–Mar 11, 2025

Exploited and recent CVEs

  • CVE-2026-100108 Medium 6.4 Social Share Buttons <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network Setting 0.2%
  • CVE-2026-109702 High 7.1 WordPress Social Share Buttons plugin <= 1.31 - Cross Site Scripting (XSS) vulnerability 0.1%
  • CVE-2026-97260 High 7.1 WordPress MaxGalleria plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-13245 Medium 6.1 MaxButtons <= 9.8.5 - Reflected Cross-Site Scripting via 'view' Parameter 0.4%
  • CVE-2021-47982 Medium 6.4 WordPress Plugin WP-Paginate 2.1.3 Stored XSS via preset 0.2%
  • CVE-2026-2312 Medium 4.3 Media Library Folders <= 8.3.6 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Attachment Deletion and Rename 0.2%
  • CVE-2025-39444 Medium 5.9 WordPress MaxButtons plugin <= 9.8.3 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2025-28933 High 7.1 WordPress MaxA/B plugin <= 2.2.2 - CSRF to Stored XSS vulnerability 0.2%
  • CVE-2025-0935 Medium 4.3 Media Library Folders <= 8.3.0 - Missing Authorization to Plugin Settings Change 0.3%
  • CVE-2024-9219 Medium 6.1 WordPress Social Share Buttons <= 1.19 - Reflected Cross-Site Scripting 0.4%
  • CVE-2024-7858 Medium 6.3 Media Library Folders <= 8.2.3 - Missing Authorization on Various Functions 0.3%
  • CVE-2024-7857 Medium 6.5 Media Library Folders <= 8.2.2 - Authenticated (Subscriber+) Second-Order SQL Injection 0.5%
  • CVE-2024-6499 Medium 5.3 WordPress Button Plugin MaxButtons <= 9.7.8 - Full Path Disclosure 0.4%
  • CVE-2024-5970 Medium 6.4 MaxGalleria <= 6.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via maxgallery_thumb Shortcode 0.3%
  • CVE-2024-3581 Medium 4.3 MaxGalleria <= 6.4.2 - Missing Authorization 0.6%
  • CVE-2024-3615 Medium 6.1 Media Library Folders <= 8.2.0 - Reflected Cross-Site Scripting via 's' 0.4%
  • CVE-2023-7029 Medium 6.4 WordPress Button Plugin MaxButtons <= 9.7.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode 0.4%
  • CVE-2023-6594 Medium 4.4 WordPress Button Plugin MaxButtons <= 9.7.4 - Authenticated (Administrator+) Stored Cross-Site Scripting 0.3%