This vulnerability affects MaxSite CMS versions 109.0 through 109.3 in the Antispam Plugin component. It involves a cross-site scripting flaw due to lack of proper output encoding on the f_logging_file argument in the /admin/plugin_antispam file. An attacker can remotely manipulate this argument to execute script code in the context of the affected site. The vendor addressed the issue in version 109.4 by applying htmlspecialchars() filtering to sanitize the input and prevent script injection. The vulnerability is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-94 (Improper Control of Generation of Code).

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to user interface manipulation or session hijacking. However, the vendor classifies this as a Self-XSS, indicating that exploitation requires user interaction with their own input, which limits the risk. There are no known exploits in the wild, and the CVSS score is medium (4.8).

Upgrade MaxSite CMS to version 109.4 or later, where the vulnerability is fixed by applying htmlspecialchars() filtering to the affected parameter. The vendor has deployed this official fix, so upgrading is the recommended remediation. No additional mitigation steps are indicated by the vendor.