MaxSite CMS versions 109.0 through 109.3 contain a cross-site scripting vulnerability in the ushki plugin due to lack of proper input sanitization on the f_ushka_new/f_ushk arguments. This allows remote attackers to perform XSS attacks by injecting malicious scripts. The vendor has addressed this by adding htmlspecialchars() filtering in version 109.4, which prevents the vulnerability by ensuring correct data display and input handling. The vulnerability is classified as Self-XSS by the vendor, indicating that exploitation requires user interaction with crafted input. The CVSS 4.8 score reflects a medium severity with network attack vector and low complexity.

The vulnerability allows remote attackers to execute cross-site scripting attacks by manipulating specific input parameters in the ushki plugin of MaxSite CMS. This could lead to the execution of malicious scripts in the context of the affected site. However, the vendor classifies this as a Self-XSS issue, implying that exploitation requires user interaction and is less likely to be exploited in widespread attacks. The vulnerability has been publicly disclosed but no known exploits in the wild have been reported.

Upgrade MaxSite CMS to version 109.4 or later, where the vulnerability is fixed by applying htmlspecialchars() filtering to the affected input parameters. This official patch addresses the root cause and prevents the XSS condition. No additional mitigation is required as the vendor has deployed this fix and recommends upgrading.