CVE-2026-7014

Vulnerability

Overview A stored cross-site scripting (XSS) vulnerability exists in the down_count plugin of MaxSite CMS versions up to 109.3. The root cause is the absence of output encoding with htmlspecialchars() when handling the f_file and f_prefix arguments, as confirmed by the vendor's own assessment [1]. This lack of sanitization allows an attacker to inject arbitrary HTML or JavaScript into the plugin's interface.

Exploitation

Path An attacker can initiate the attack remotely by crafting a malicious payload in the f_file or f_prefix parameter [1]. Since the parameter values are stored and later displayed without proper escaping, the injected script executes in the context of the affected admin page. The vendor classifies this as 'Self-XSS', meaning the attacker must trick an authenticated administrator into visiting a specially crafted link or submit the payload themselves [1].

Impact

Successful exploitation results in the execution of attacker-controlled scripts within the browser session of the administrator, potentially leading to unauthorized actions, data theft, or configuration changes under the admin's privileges. The CVSS v3 base score of 2.4 (Low) reflects the need for user interaction and the limited scope of self-XSS [CVE description].

Mitigation

The issue is addressed in version 109.4, which applies htmlspecialchars() to the affected parameters [1]. Users are advised to upgrade to the latest version [2]. A patch identified by commit hash 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7 is available in the official repository [1].