This vulnerability in MaxSite CMS (up to version 109.3) affects the Redirect Plugin where the f_all/f_all404 argument is not properly sanitized, leading to cross-site scripting (XSS). The attack can be performed remotely but requires user interaction (UI:P) and privileges (PR:H). The vendor has addressed the issue by adding htmlspecialchars() filtering in version 109.4, which prevents malicious script injection and incorrect data display. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-94 (Improper Control of Generation of Code). The CVSS 4.0 vector indicates network attack vector, low attack complexity, and partial impact on integrity and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected site, potentially leading to data disclosure or manipulation of displayed content. However, the vendor classifies this as a Self-XSS, implying that exploitation requires user interaction and is less likely to be leveraged for widespread attacks. There are no known exploits in the wild, and the impact is rated medium.

Upgrade MaxSite CMS to version 109.4 or later, where the vulnerability is fixed by applying htmlspecialchars() filtering to the affected input parameters. This official patch mitigates the issue by preventing improper data display and script injection. No additional mitigation is required as the vendor has addressed the vulnerability in the latest release.