PT-2026-35194 · Unknown · Maxsite Cms

Konchan · CVE-2026-7013 · Published 2026-04-26 · Updated 2026-04-26

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:N/AC:L/Au:M/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MaxSite CMS versions prior to 109.4

Description A cross-site scripting issue exists in the mail send plugin. Remote attackers can initiate an attack by manipulating the f subject, f files, or f from arguments. This occurs due to a lack of filtering via the htmlspecialchars() function, which is used to convert special characters to HTML entities to prevent the browser from interpreting them as code.

Recommendations Upgrade to version 109.4.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2026-7013

Affected Products

Maxsite Cms

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7013.json · Exploit
• 🔥 https://github.com/wnaspy/CVE/blob/main/Report-%20Stored%20XSS-in-mail_send-plugin-maxsite-cms.pdf.pdf · Exploit
• https://github.com/maxsite/cms/releases/tag/v109 · Patch
• https://github.com/maxsite/cms/commit/8a3946bd0a54bfb72a4d57179fcd253f2c550cd7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-7013 · Security Note
• https://osv.dev/vulnerability/CVE-2026-7013 · Vendor Advisory
• https://twitter.com/CVEarity/status/2048308710519529856 · Twitter Post
• https://vuldb.com/vuln/359592/cti · Note
• https://twitter.com/VulmonFeeds/status/2048251198482812951 · Twitter Post
• https://github.com/maxsite/cms · Note
• https://vuldb.com/submit/796738 · Note
• https://twitter.com/CVEnew/status/2048481065963020523 · Twitter Post
• https://vuldb.com/vuln/359592 · Note