Maxfoundry develops a focused portfolio of WordPress plugins and extensions, including MaxButtons, Media Library Folders, WP Paginate, and MaxGalleria, that serve content management and presentation functions across a large installed base of WordPress sites. The vendor's vulnerability disclosures cluster around application-layer input handling and access control, with recurring weakness classes including cross-site scripting, SQL injection, cross-site request forgery, missing authorization, and exposure of sensitive information. These vulnerability classes are characteristic of web-application plugins that handle user input, manage database queries, and interact with WordPress authentication and permission systems. Defenders should treat Maxfoundry plugin updates as part of routine WordPress site hardening and audit administrative access to affected components. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Maxfoundry over time
Signals from CVEs in this vendor scope (26 CVEs).
26 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-36346HIGH Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Max Foundry MaxButtons plugin <= 9.2 at WordPress. | Aug 22, 2022 | 8.8 | 28 | NO | NO |
CVE-2022-41634HIGH Cross-Site Request Forgery (CSRF) vulnerability in Media Library Folders plugin <= 7.1.1 on WordPress. | Nov 18, 2022 | 8.8 | 27 | NO | NO |
CVE-2024-30486HIGH Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Max Foundry Media Library Folders.This issue affects Media Library Folders: fr | Mar 29, 2024 | 8.8 | 23 | NO | NO |
CVE-2024-3615MEDIUM The Media Library Folders plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 8.2.0 due to insufficient | Apr 19, 2024 | 6.1 | 21 | NO | NO |
CVE-2014-125092MEDIUM A vulnerability was found in MaxButtons Plugin up to 1.26.0 on WordPress and classified as problematic. This issue affects the function maxbuttons_strip_px of the file includes/max | Mar 5, 2023 | 6.1 | 21 | NO | NO |
CVE-2024-7857MEDIUM The Media Library Folders plugin for WordPress is vulnerable to second order SQL Injection via the 'sort_type' parameter of the 'mlf_change_sort_type' AJAX action in all versions u | Aug 29, 2024 | 6.5 | 20 | NO | NO |
CVE-2024-9219MEDIUM The WordPress Social Share Buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in a | Oct 19, 2024 | 6.1 | 19 | NO | NO |
CVE-2024-7858MEDIUM The Media Library Folders plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several AJAX functions in the media-library-plus.php file in | Aug 30, 2024 | 6.3 | 19 | NO | NO |
CVE-2024-5970MEDIUM The MaxGalleria plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's maxgallery_thumb shortcode in all versions up to, and including, 6.4.4 due to ins | Jun 18, 2024 | 6.4 | 19 | NO | NO |
CVE-2023-36503MEDIUM Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Max Foundry WordPress Button Plugin MaxButtons plugin <= 9.5.3 versions. | Jul 25, 2023 | 5.4 | 19 | NO | NO |
Signals from CVEs in this vendor scope (26 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Maxfoundry.
Media articles that mention a CVE ID that affects a product developed by Maxfoundry — matched by CVE ID, not by vendor name.