MWW Disclaimer Buttons
MWW Disclaimer Buttons has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; all 2 are fixed as of September 2026. Their average CVSS score is 4.4, and the most serious one scores 4.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).
Every one of the 2 issues recorded for MWW Disclaimer Buttons has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. MWW Disclaimer Buttons is installed on roughly 400 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2025-60154MWW Disclaimer Buttons <= 3.41 - Authenticated (Administrator+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
MWW Disclaimer Buttons
Author
Jennifer Moss
For bloggers/content creators that accept free products or compensation for reviews, or use affiliate links, the FTC requires that you put disclosures at the top of any post or page. This plugin creates an options box in the POST or PAGE editor for you to add each of these buttons to your post without having to include it in post text. [Affiliate Links] – Blogger makes money when someone clicks on link and purchases product from 3rd party vendor. [PR Sample] – Free product was received by blogger in exchange for a review and/or post. [Sponsored] – Blogger was paid directly for the post/page. The disclaimer buttons appear below the title and above the text on a single post or page–they do not appear on excerpts nor your RSS feed. Markdown Admin Page for entering disclaimer URL Settings box on post page Appends buttons to the_content() (post text) on single post or page only.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C