A vulnerability was found in MaxSite CMS up to 109.3 and classified as problematic. This issue affects some unknown processing of the component Guestbook Plugin. Such manipulation of the argument f_text/f_slug/f_limit/f_email leads to cross site scripting.
This vulnerability is traded as CVE-2026-7015. The attack may be launched remotely. Furthermore, there is an exploit available.
It is suggested to upgrade the affected component.
The vendor was informed early about this issue. They classify it as a “Self-XSS”. They deployed a countermeasure: “Nevertheless, we consider this a violation of secure coding standards. The lack of filtering via `htmlspecialchars()` has already been fixed in the latest patch to prevent incorrect data display.”
