This vulnerability in MaxSite CMS up to version 109.3 involves insufficient input filtering in the Guestbook Plugin, specifically in the handling of the arguments f_text, f_slug, f_limit, and f_email. This leads to a cross-site scripting condition where an attacker can inject scripts that may be executed in the context of a victim's browser. The vendor has acknowledged the issue as a Self-XSS and released a patch in version 109.4 that applies htmlspecialchars() filtering to prevent improper data display and script injection.

The vulnerability allows remote attackers to perform cross-site scripting attacks by injecting malicious scripts via specific input parameters in the Guestbook Plugin. While classified as Self-XSS by the vendor, this can still lead to script execution in the user's browser, potentially impacting user trust and data integrity. The CVSS score of 4.8 reflects a medium severity with network attack vector, low attack complexity, and no privileges required but user interaction needed.

A patch is available in MaxSite CMS version 109.4 that fixes the vulnerability by applying htmlspecialchars() filtering to the affected input parameters. Users of affected versions (109.0 through 109.3) should upgrade to version 109.4 to remediate this issue. The vendor has deployed this official fix and recommends upgrading to prevent incorrect data display and script injection.