MaxSite CMS versions 109.0 through 109.3 contain a cross-site scripting vulnerability in the Antispam Plugin component, specifically related to the f_logging_file argument in the /admin/plugin_antispam file. This vulnerability allows remote attackers to inject malicious scripts due to a lack of proper output encoding. The vendor has addressed this issue by applying htmlspecialchars() filtering in version 109.4, which prevents the injection of executable code in the affected parameter. The vulnerability is classified as Self-XSS by the vendor, indicating that exploitation requires some user interaction or context. The CVSS 4.0 base score is 4.8, reflecting medium severity with network attack vector, low attack complexity, and requiring high privileges and partial user interaction.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected CMS administrative interface, potentially leading to session hijacking or unauthorized actions within the CMS. However, the vendor classifies this as a Self-XSS vulnerability, which typically requires user interaction and is less severe than other XSS types. There are no known active exploits in the wild at this time.

Upgrade MaxSite CMS to version 109.4 or later, where the vulnerability is fixed by applying htmlspecialchars() filtering to the affected parameter. This official patch addresses the issue and prevents incorrect data display that leads to XSS. No additional mitigation is required beyond applying the vendor's update.