MaxSite CMS versions 109.0 through 109.3 contain a cross-site scripting vulnerability in the mail_send plugin due to lack of proper input sanitization on the f_subject, f_files, and f_from parameters. This allows remote attackers to inject scripts that may be executed in the context of the affected application. The vendor has addressed this by implementing htmlspecialchars() filtering in version 109.4, which prevents improper data display and mitigates the vulnerability. The vendor considers this a Self-XSS issue but acknowledges it violates secure coding standards.

The vulnerability allows remote attackers to perform cross-site scripting attacks by manipulating specific input parameters in the mail_send plugin. This could lead to script execution in the context of the user interface, potentially affecting user interaction with the CMS. However, the vendor classifies this as Self-XSS, indicating limited impact as it typically requires user interaction to exploit. No known active exploits have been reported.

Upgrade MaxSite CMS to version 109.4 or later, where the vulnerability is fixed by applying htmlspecialchars() filtering to the affected input parameters. This official fix prevents improper data display and mitigates the XSS risk. No additional mitigation steps are indicated by the vendor.