CVE-2026-7015
Cross-Site Scripting in MaxSite CMS Guestbook Plugin
Publication date: 2026-04-26
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| maxsite | maxsite_cms | to 109.4 (exc) |
| maxsite | guestbook_plugin | to 2.1 (exc) |
| maxsite | antispam_plugin | to 1.3 (exc) |
| maxsite | down_count_plugin | to 1.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in MaxSite CMS up to version 109.3, specifically in the Guestbook Plugin component. It involves improper handling of certain input arguments such as f_text, f_slug, f_limit, and f_email, which can lead to a cross-site scripting (XSS) attack. This means that an attacker can inject malicious scripts remotely by manipulating these inputs. The issue arises because user inputs were not properly sanitized using functions like htmlspecialchars(), allowing unsafe data to be displayed.
The vulnerability has been publicly disclosed and can be exploited remotely. The vendor has addressed this issue in version 109.4 by applying proper input sanitization to prevent incorrect data display and mitigate XSS risks.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to perform cross-site scripting (XSS) attacks on your MaxSite CMS website if you are using the affected Guestbook Plugin version up to 109.3. Such attacks can lead to the execution of malicious scripts in the context of your website, potentially compromising user sessions, stealing sensitive information, or defacing your site.
Since the attack can be launched remotely, it poses a risk to both the website administrators and visitors. However, the vulnerability is classified as a "Self-XSS" by the vendor, indicating that exploitation might require some user interaction or trickery.
Upgrading to version 109.4 of MaxSite CMS, which includes the patch, is recommended to mitigate this risk.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves cross-site scripting (XSS) via manipulation of the arguments f_text, f_slug, f_limit, and f_email in the Guestbook Plugin of MaxSite CMS up to version 109.3.
To detect this vulnerability on your system, you can attempt to inject typical XSS payloads into these parameters and observe if the input is improperly rendered without escaping, indicating a vulnerability.
Example commands using curl to test the Guestbook Plugin endpoints might be:
- curl -G 'http://your-maxsite-url/guestbook' --data-urlencode 'f_text=<script>alert(1)</script>'
- curl -G 'http://your-maxsite-url/guestbook' --data-urlencode 'f_slug=<script>alert(1)</script>'
- curl -G 'http://your-maxsite-url/guestbook' --data-urlencode 'f_limit=<script>alert(1)</script>'
- curl -G 'http://your-maxsite-url/guestbook' --data-urlencode 'f_email=<script>alert(1)</script>'
If the response contains the injected script tags unescaped, it indicates the presence of the vulnerability.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade MaxSite CMS and its plugins to version 109.4 or later, which includes a patch that applies proper input sanitization using the htmlspecialchars() function to prevent XSS.
This update addresses the vulnerability by escaping user inputs in the Guestbook Plugin and other components, preventing malicious script injection.
Until the upgrade can be applied, consider restricting access to the affected plugins or disabling the Guestbook Plugin to reduce exposure.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in MaxSite CMS up to version 109.3 involves a cross-site scripting (XSS) issue due to improper input sanitization in the Guestbook Plugin. Such XSS vulnerabilities can lead to unauthorized script execution, which may compromise user data confidentiality and integrity.
While the CVE description and resources do not explicitly mention compliance with standards like GDPR or HIPAA, XSS vulnerabilities generally pose risks to data protection and privacy requirements mandated by these regulations. Failure to prevent such vulnerabilities could potentially lead to non-compliance due to exposure of personal data or unauthorized access.
The vendor has classified this as a violation of secure coding standards and has addressed it by applying proper input filtering (using htmlspecialchars()) in version 109.4, which helps mitigate the risk and supports compliance efforts by reducing the likelihood of data breaches caused by XSS.