The MaxButtons – Create buttons plugin for WordPress suffers from a reflected cross-site scripting vulnerability in the 'view' parameter in all versions up to and including 9.8.5. Due to inadequate input sanitization and output escaping, attackers can inject malicious scripts that execute in the context of a user's browser if the user is tricked into clicking a crafted link. This vulnerability does not require authentication and can lead to limited confidentiality and integrity impacts but no availability impact. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impacts.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure and manipulation of web content. There is no impact on system availability. The vulnerability affects confidentiality and integrity to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable plugin or applying web application firewall rules to block malicious input targeting the 'view' parameter. Avoid clicking on suspicious links that may exploit this vulnerability.