A vulnerability, which was classified as problematic, has been found in MaxSite CMS up to 109.3. Affected by this issue is some unknown functionality of the component mail_send Plugin. The manipulation of the argument f_subject/f_files/f_from leads to cross site scripting.
This vulnerability is documented as CVE-2026-7013. The attack can be initiated remotely. Additionally, an exploit exists.
It is advisable to upgrade the affected component.
The vendor was informed early about this issue. They classify it as a “Self-XSS”. They deployed a countermeasure: “Nevertheless, we consider this a violation of secure coding standards. The lack of filtering via `htmlspecialchars()` has already been fixed in the latest patch to prevent incorrect data display.”
