The vulnerability is an uncontrolled input parameter in the f_all/f_all404 arguments of the Redirect Plugin that allows a remote attacker to embed arbitrary script. An attacker can execute scripts in the context of the site, potentially hijacking sessions, defacing content, or spreading malware. Because the flaw is stored in the CMS database, the injected payload can persist across users and sessions. The weakness is categorized as Cross‑Site Scripting, specifically an input validation flaw.

The issue appears in MaxSite CMS versions up to 109.3, specifically affecting the Redirect Plugin component. Users running those versions are susceptible until they upgrade to 109.4 or later, where htmlspecialchars filtering has been added.

With a CVSS score of 4.8 the vulnerability is considered moderate. The EPSS score is less than 1 %, indicating a low publicly observed exploitation probability, and the vulnerability is not listed in CISA’s KEV. The attack is remote, via the web interface, and does not require authentication, so unauthenticated users may supply malicious payloads through the affected parameters.