The vulnerability in MaxSite CMS allows attackers to inject malicious scripts into the Guestbook Plugin by manipulating the arguments f_text, f_slug, f_limit, or f_email. This stored XSS flaw can be triggered remotely through standard web requests to the plugin’s input forms, and once the input is persisted, any user viewing the affected page will have the script executed in their browser. The impact includes potential session hijacking, data theft, or defacement of the site by an attacker. Both the type of weakness and the attack scenario are consistent with CWE-79 and CWE-94 as documented.

MaxSite CMS versions up to and including 109.3 are affected. The Guestbook Plugin is the component that contains the flaw. An update to version 109.4 (patch 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7) removes the unsafe handling of user input.

The CVSS score of 4.8 indicates moderate risk, although the EPSS score of less than 1% reflects a very low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, suggesting it has not been widely abused. Nonetheless, because the vulnerability is exploitable remotely and results in cross site scripting, it remains a relevant concern for sites that use the Guestbook Plugin and can grant attackers control over user sessions or site content.