PT-2026-35198 · Cms Maxsite+1 · Ushki Plugin+1

Konchan · CVE-2026-7016 · Published 2026-04-26 · Updated 2026-04-26

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:N/AC:L/Au:M/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MaxSite CMS versions prior to 109.4

Description A cross-site scripting issue exists in the ushki Plugin. Manipulation of the f ushka new/f ushk argument allows remote exploitation due to a lack of filtering via the htmlspecialchars() function, which is used to convert special characters to HTML entities to prevent the browser from interpreting them as code.

Recommendations Update to version 109.4.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2026-7016

Affected Products

Maxsite Cms

Ushki Plugin

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7016.json · Exploit
• 🔥 https://github.com/wnaspy/CVE/blob/main/Report-%20Stored%20XSS-in-ushki-plugin-maxsite-cms.pdf.pdf · Exploit
• https://github.com/maxsite/cms/releases/tag/v109 · Patch
• https://github.com/maxsite/cms/commit/8a3946bd0a54bfb72a4d57179fcd253f2c550cd7 · Patch
• https://osv.dev/vulnerability/CVE-2026-7016 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7016 · Security Note
• https://vuldb.com/vuln/359596 · Note
• https://twitter.com/CVEnew/status/2048481057746423838 · Twitter Post
• https://vuldb.com/vuln/359596/cti · Note
• https://vuldb.com/submit/796741 · Note
• https://github.com/maxsite/cms · Note
• https://twitter.com/CVEarity/status/2048319821151183090 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2048264001897799721 · Twitter Post