PT-2026-35180 · Cms Maxsite+1 · Redirect Plugin+1

Konchan · CVE-2026-7012 · Published 2026-04-26 · Updated 2026-04-26

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:N/AC:L/Au:M/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MaxSite CMS versions prior to 109.4

Description An issue exists in the Redirect Plugin where the manipulation of the f all or f all404 arguments allows for cross-site scripting (XSS), a condition where malicious scripts are injected into trusted websites. This occurs due to a lack of filtering via the htmlspecialchars() function, which is used to convert special characters to HTML entities to prevent the browser from interpreting them as code. The attack can be executed remotely.

Recommendations Upgrade to version 109.4.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2026-7012

Affected Products

Maxsite Cms

Redirect Plugin

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7012.json · Exploit
• 🔥 https://github.com/wnaspy/CVE/blob/main/Report-%20Stored%20XSS-in-redirect-plugin-maxsite-cms.pdf.pdf · Exploit
• https://github.com/maxsite/cms/releases/tag/v109 · Patch
• https://github.com/maxsite/cms/commit/8a3946bd0a54bfb72a4d57179fcd253f2c550cd7 · Patch
• https://osv.dev/vulnerability/CVE-2026-7012 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7012 · Security Note
• https://twitter.com/CVEnew/status/2048481067498115386 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2048228142599266394 · Twitter Post
• https://vuldb.com/vuln/359593/cti · Note
• https://github.com/maxsite/cms · Note
• https://vuldb.com/submit/796737 · Note
• https://vuldb.com/vuln/359593 · Note
• https://twitter.com/CVEarity/status/2048303150248153249 · Twitter Post