A vulnerability was identified in the ushki Plugin of MaxSite CMS versions up to 109.3 that allows an attacker to inject malicious scripts via the f_ushka_new and f_ushk input parameters. The lack of proper output filtering (e.g., missing htmlspecialchars()) enables a stored cross‑site scripting flaw (CWE‑79) that can be triggered remotely. An attacker who successfully injects JavaScript could hijack user sessions, deface content, or exfiltrate sensitive data from the victim’s browser.

The issue affects all installations of MaxSite CMS running the ushki Plugin with version numbers up to and including 109.3. The vendor’s security advisory specifies that upgrading to version 109.4, which contains patch commit 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7, resolves the flaw. No other product versions or vendors are listed, so the vulnerability is specific to MaxSite CMS.

The CVSS score of 4.8 indicates a moderate severity, and the EPSS score of <1% reflects a very low probability of exploitation at this time. Nonetheless, the vulnerability has a publicly available exploit, and remote exploitation is feasible via crafted web requests to the affected plugin. This flaw is not currently listed in the CISA KEV catalog, but the public nature of the exploit means administrators should not underestimate the risk. Implementing the recommended patch and validating that input is properly sanitized remain the key mitigations.