CVE-2017-2169

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-site scripting vulnerability in MaxButtons prior to version 6.19 and MaxButtons Pro prior to version 6.19 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Max Foundry	MaxButtons	prior to version 6.19
Max Foundry	MaxButtons Pro	prior to version 6.19

References

http://jvndb.jvn.jp/jvndb/JVNDB-2017-000093Third Party Advisory, VDB Entry
https://jvn.jp/en/jp/JVN70411623/index.htmlThird Party Advisory, VDB Entry
https://wordpress.org/plugins/maxbuttons/#developersRelease Notes, Vendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2017-000093Third Party Advisory, VDB Entry
https://jvn.jp/en/jp/JVN70411623/index.htmlThird Party Advisory, VDB Entry
https://wordpress.org/plugins/maxbuttons/#developersRelease Notes, Vendor Advisory

Timeline

Published: May 22, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-21716.1Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version CVE-2017-21726.1Cross-site scripting vulnerability in Cybozu KUNAI for Android 3.0.0 to 3.0.6 allows remote attackers to inject arbitrary web script or HTML CVE-2017-21735.4Cross-site scripting vulnerability in Empirical Project Monitor - eXtended all versions allows remote authenticated attackers to inject arbi CVE-2017-21746.1Cross-site scripting vulnerability in Empirical Project Monitor - eXtended all versions allows remote attackers to inject arbitrary web scri CVE-2017-21757.8Untrusted search path vulnerability in Empirical Project Monitor - eXtended all versions allows remote attackers to gain privileges via a Tr CVE-2017-21767.8Untrusted search path vulnerability in screensaver installers (jasdf_01.exe, jasdf_02.exe, jasdf_03.exe, jasdf_04.exe, jasdf_05.exe, scrambl CVE-2017-21778.8Untrusted search path vulnerability in Installer of Shogyo Touki Denshi Ninsho Software Ver 1.7 and earlier allows an attacker to gain privi CVE-2017-21788.8Untrusted search path vulnerability in Installer of electronic tendering and bid opening system available prior to May 25, 2017 allows an at CVE-2017-21798.8Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allows remote code execution via unspecified vectors, CVE-2017-21804.3Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspe CVE-2017-21818.8Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspe CVE-2017-21828.8Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspe