CVE-2026-7013

Vulnerability

Overview

CVE-2026-7013 is a stored cross-site scripting (XSS) vulnerability found in MaxSite CMS versions up to 109.3. The issue resides in the mail_send plugin, where the parameters f_subject, f_files, and f_from are not properly sanitized before being processed. The vendor classifies this as a "Self-XSS" and states that the lack of filtering via htmlspecialchars() has been fixed in the latest patch [1].

Exploitation

An attacker can exploit this vulnerability remotely by crafting malicious input in the affected parameters of the mail_send plugin. The attack does not require authentication, as the plugin's functionality is accessible to unauthenticated users. The exploit has been publicly disclosed, increasing the risk of active exploitation [4].

Impact

Successful exploitation allows an attacker to inject arbitrary JavaScript code into the application's context. Since this is classified as a Self-XSS, the injected script would execute in the context of the victim's session, potentially leading to data theft, session hijacking, or other client-side attacks. The CVSS v3 score of 2.4 reflects the low severity due to the self-XSS nature, but the public availability of exploit details elevates the practical risk.

Mitigation

The vulnerability is patched in MaxSite CMS version 109.4. The fix involves adding htmlspecialchars() to sanitize the f_logging_file parameter, which addresses the root cause of the XSS [1]. Users are strongly advised to upgrade to version 109.4 or apply the patch commit 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7 [1]. No workarounds have been provided by the vendor.