This vulnerability in MaxSite CMS (up to version 109.3) involves a cross-site scripting flaw in the down_count plugin due to lack of proper input sanitization on the f_file/f_prefix parameters. An attacker can remotely manipulate these parameters to inject scripts. The vendor has fixed the issue in version 109.4 by implementing htmlspecialchars() filtering to prevent improper data display. The vulnerability is classified as 'Self-XSS' by the vendor, indicating that exploitation requires user interaction. The CVSS 4.8 score reflects medium severity with network attack vector and low impact on confidentiality and integrity.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected user's browser, potentially leading to session hijacking or other client-side impacts. However, the vendor's classification as 'Self-XSS' suggests that exploitation requires the victim's deliberate action, reducing the risk of widespread automated attacks. There are no known exploits in the wild at this time.

Upgrade MaxSite CMS to version 109.4 or later, where the vulnerability is fixed by adding htmlspecialchars() filtering to the affected parameters. This official patch resolves the issue and no further action is required.