A stored cross‑site scripting vulnerability exists in the down_count plugin of MaxSite CMS. By manipulating the f_file or f_prefix parameters, an attacker can inject arbitrary scripts that are rendered as page content. If successful, the injected code executes in the browsers of other users who view the affected page, potentially allowing session hijacking, credential theft, or defacement. The flaw is caused by inadequate filtering of user input before it is displayed and is classified by the vendor as a Self‑XSS type of misuse.

All installations of MaxSite CMS up to but not including version 109.4 that use the down_count plugin are affected. The vulnerability is limited to the code of this specific plugin and can be remedied by upgrading the CMS to version 109.4 or higher, which contains the corrected plugin.

The overall cyber security impact rating is a moderate CVSS score of 4.8, and the EPSS score of less than 1% indicates a low likelihood of exploitation in the general environment. The vulnerability is not listed as a known exploited vulnerability by CISA. An attacker can trigger the flaw remotely by sending crafted HTTP requests that provide malicious values for f_file or f_prefix; the published exploit demonstrates the feasibility of this attack vector.