MaxSite CMS versions 109.0 through 109.3 contain a cross-site scripting vulnerability in the ushki Plugin due to lack of proper input sanitization on the f_ushka_new/f_ushk parameters. This allows remote attackers to perform script injection. The vendor has addressed the issue in version 109.4 by implementing htmlspecialchars() filtering to prevent XSS. The vulnerability is classified as Self-XSS by the vendor, indicating that exploitation requires user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, and requires user interaction with high privileges.

Successful exploitation could allow an attacker to inject malicious scripts that execute in the context of the affected user's browser, potentially leading to data disclosure or session hijacking. However, the vendor classifies this as a Self-XSS vulnerability, which typically requires user interaction and is less severe than other XSS types. No known active exploits have been reported.

Upgrade MaxSite CMS to version 109.4 or later, where the vulnerability is fixed by adding htmlspecialchars() filtering to the affected parameters. This official patch addresses the issue and prevents incorrect data display. No additional mitigation is required beyond applying the update.