This vulnerability in MaxSite CMS affects the Guestbook Plugin's processing of input parameters f_text, f_slug, f_limit, and f_email, allowing cross-site scripting due to lack of proper output encoding. The vendor fixed the issue by adding htmlspecialchars() filtering in version 109.4, which prevents incorrect data display and mitigates the XSS risk. The vulnerability is classified as a 'Self-XSS' by the vendor, indicating that exploitation requires user interaction with their own input. The CVSS 4.0 base score is 4.8 (medium severity), reflecting network attack vector, low complexity, and required user interaction.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected user's browser, potentially leading to session hijacking or other client-side impacts. However, since the vendor classifies this as a 'Self-XSS', the risk is somewhat limited as it requires the victim to interact with malicious input they control. There are no known exploits in the wild at this time.

A fix is available in MaxSite CMS version 109.4, which includes proper filtering of input via htmlspecialchars() to prevent XSS. It is recommended to upgrade affected installations to version 109.4 to remediate this vulnerability. Since the vendor has deployed this official fix, no additional mitigation steps are necessary.