This vulnerability in MaxSite CMS (up to version 109.3) involves a cross-site scripting flaw in the Redirect Plugin component. The issue stems from the lack of proper sanitization of the f_all/f_all404 argument, which can be manipulated remotely to inject malicious scripts. The vendor has fixed this by implementing htmlspecialchars() filtering in version 109.4 to prevent incorrect data display. Although the vendor considers this a "Self-XSS" and a violation of secure coding standards, the vulnerability is real and publicly disclosed. The patch is identified by commit 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7.

Successful exploitation could allow an attacker to execute cross-site scripting attacks by injecting malicious scripts via the f_all/f_all404 argument in the Redirect Plugin. This could lead to script execution in the context of the affected user's browser. However, the vendor classifies this as a "Self-XSS," which typically requires user interaction to exploit and is generally considered less severe than other XSS types. The CVSS score of 4.8 reflects a medium severity impact.

Upgrade MaxSite CMS to version 109.4 or later, where the vulnerability has been fixed by adding proper htmlspecialchars() filtering to the affected argument. This official patch effectively mitigates the issue. No additional mitigation steps are indicated by the vendor.