This vulnerability in MaxSite CMS (up to version 109.3) involves cross-site scripting through the mail_send plugin due to lack of proper input sanitization on certain parameters (f_subject, f_files, f_from). Attackers can remotely trigger script injection by manipulating these arguments. The vendor has addressed this issue in version 109.4 by adding htmlspecialchars() filtering to the affected inputs, thereby preventing the injection of malicious HTML or scripts. The vendor considers this a violation of secure coding standards but classifies it as a Self-XSS scenario. The vulnerability has a CVSS 4.8 (medium) rating and no known active exploitation.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected user's browser, potentially leading to session hijacking or other client-side impacts. However, the vendor classifies this as a Self-XSS issue, which typically requires user interaction to exploit and is less severe than typical reflected or stored XSS. No known exploits are reported in the wild.

Upgrade MaxSite CMS to version 109.4 or later, where the vendor has implemented a fix by applying htmlspecialchars() filtering to the vulnerable input parameters. This official patch resolves the vulnerability by preventing improper data display. No additional mitigation is required beyond applying the update.