The vulnerability resides in the Antispam Plugin of MaxSite CMS, where manipulation of the f_logging_file argument allows an attacker to inject malicious script code that is then rendered in the user interface. This stored cross‑site scripting flaw means that a remote user can cause arbitrary script execution in the browsers of any user who views the affected page, enabling phishing, credential theft, or other malicious actions. The weakness is classified under CWE‑79 for input data not validated for HTML context and CWE‑94 for code injection potential.

All installations of MaxSite CMS containing the Antispam Plugin with a component version of 109.3 or earlier are affected. The vendor identifies the fix in release 109.4, so any version lower than 109.4, including 109.0 through 109.3, must be upgraded. The plugin resides at /admin/plugin_antispam and is part of the main CMS core. Systems running newer releases beyond 109.4 are not vulnerable.

The CVSS base score is 4.8, reflecting a moderate impact that primarily threatens confidentiality and integrity through client‑side script execution. The EPSS score of less than 1% indicates a low probability of exploitation in the wild; however, public proof‑of‑concept code exists, so an attacker could still launch an attack if no patch is applied. The vulnerability is not listed in the CISA KEV catalog, but the publicly available exploit warrants prompt remediation.