Input validation vulnerability in WordPress Button Plugin MaxButtons 9.7.4

The MaxButtons plugin for WordPress is vulnerable to a type of attack called Stored Cross-Site Scripting (XSS). This type of attack can happen when an attacker, who has administrator-level access, injects malicious code into a page. This code can then be executed whenever a user accesses the page. This vulnerability affects multi-site installations and installations where certain security features have been disabled. If an administrator has given button creation privileges to users with lower levels, those users could potentially carry out the attack.