PT-2026-35195 · Cms Maxsite+1 · Countdown+1

Konchan · Published 2026-04-26 · Updated 2026-04-26 · CVE-2026-7014

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:N/AC:L/Au:M/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MaxSite CMS versions prior to 109.4

Description A flaw in the down count plugin allows for cross-site scripting (XSS) via the manipulation of the f file and f prefix arguments. This issue occurs due to a lack of filtering using the htmlspecialchars() function, which is used to convert special characters to HTML entities to prevent the browser from interpreting them as code.

Recommendations Upgrade to version 109.4.

Exploit

Fix

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

CVE-2026-7014

Affected Products

Maxsite Cms

Countdown

References · 11

• 🔥 https://github.com/wnaspy/CVE/blob/main/Report-%20Stored%20XSS-in-down_count-plugin-maxsite-cms.pdf.pdf · Exploit
• https://github.com/maxsite/cms/commit/8a3946bd0a54bfb72a4d57179fcd253f2c550cd7 · Patch
• https://github.com/maxsite/cms/releases/tag/v109 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-7014 · Security Note
• https://github.com/maxsite/cms · Note
• https://twitter.com/VulmonFeeds/status/2048248638657171880 · Twitter Post
• https://twitter.com/CVEarity/status/2048311489258508575 · Twitter Post
• https://vuldb.com/vuln/359594/cti · Note
• https://twitter.com/CVEnew/status/2048481064176242799 · Twitter Post
• https://vuldb.com/vuln/359594 · Note
• https://vuldb.com/submit/796739 · Note