CVE-2026-7012mediumCWE-79CWE-94

CVE-2026-7012: fallo de gravedad media en MaxSite CMS

MaxSite CMS Redirect Plugin cross site scripting

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear CMS

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

33Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 4.8epss 0.3%
A vulnerability was detected in MaxSite CMS up to 109.3. This affects an unknown part of the component Redirect Plugin. The manipulation of the argument f_all/f_all404 results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used. Upgrading to version 109.4 is able to mitigate this issue. The patch is identified as 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7. You should upgrade the affected component. The vendor was informed early about this issue. They classify it as a "Self-XSS". They deployed a countermeasure: "Nevertheless, we consider this a violation of secure coding standards. The lack of filtering via `htmlspecialchars()` has already been fixed in the latest patch to prevent incorrect data display."
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Productos afectados
MaxSite · CMS
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — MaxSite CMS

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-3395MEDIUMMaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injectionEPSS 4.0%CVE-2025-12347MEDIUMMaxSite CMS save-file-ajax.php unrestricted uploadEPSS 0.4%CVE-2025-12346MEDIUMMaxSite CMS HTTP Header uploads-require-maxsite.php unrestricted uploadEPSS 0.4%CVE-2026-7014MEDIUMMaxSite CMS down_count Plugin cross site scriptingEPSS 0.3%CVE-2026-7011MEDIUMMaxSite CMS Antispam Plugin plugin_antispam cross site scriptingEPSS 0.3%CVE-2026-7016MEDIUMMaxSite CMS ushki Plugin cross site scriptingEPSS 0.2%