A flaw exists in the mail_send plugin of MaxSite CMS through version 109.3 that allows an attacker to embed arbitrary JavaScript into the f_subject, f_files, or f_from fields. The injected code is rendered in browsers without proper output encoding, creating a stored cross‑site scripting (XSS) vector. The vendor classifies it as a Self‑XSS issue and notes that the lack of htmlspecialchars() filtering caused the vulnerability.

MaxSite CMS (MaxSite:CMS) versions up to 109.3 are affected, specifically the mail_send component which accepts the f_subject, f_files, and f_from parameters. Installing the patch released in version 109.4 (commit 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7) removes the flaw by adding the necessary output sanitization.

The CVSS score of 4.8 indicates moderate severity, while the EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting a low current exploitation probability. The attack is remotely accessible; an adversary only needs to submit a crafted request to the mail_send endpoint, after which the malicious script is stored and executed for any user who views the content. Public disclosure is available, so unpatched installations remain susceptible to repeated exploitation by anyone with network access to the CMS.