A cross‑site scripting flaw exists in the backend file upload endpoint of MaxSite CMS version 109.2. An attacker who can reach this endpoint can embed malicious script in the uploaded file. When a privileged user views or processes the file, the script runs in that user’s browser, permitting theft of account cookies, session tokens, or other confidential information. The flaw enables an attacker to compromise the confidentiality of administrative accounts and any data the user can access.

Systems running MaxSite CMS 109.2 are vulnerable. No other versions are specified as affected, but the lack of a vendor patch suggests that only this exact build is known to be impacted.

Based on the description, it is inferred that the vulnerability is exploitable from any network location that can reach the CMS backend, so remote attackers can launch the exploit without local access. The CVSS score of 4.1 and an EPSS score of <1% indicate a moderate risk and low likelihood of exploitation. The issue is not listed in CISA’s KEV catalog, but the presence of a functional XSS vector on an administrative interface indicates a risk to sensitive data. A successful payload could bypass user authorization by operating within the context of the stored session of an authenticated admin user.