A vulnerability has been found in MaxSite CMS up to 109.3 and classified as problematic. This vulnerability affects unknown code of the component down_count Plugin. This manipulation of the argument f_file/f_prefix causes cross site scripting.
This vulnerability appears as CVE-2026-7014. The attack may be initiated remotely. In addition, an exploit is available.
The affected component should be upgraded.
The vendor was informed early about this issue. They classify it as a “Self-XSS”. They deployed a countermeasure: “Nevertheless, we consider this a violation of secure coding standards. The lack of filtering via `htmlspecialchars()` has already been fixed in the latest patch to prevent incorrect data display.”
