CVE-2026-7011: MaxSite CMS Antispam Plugin XSS Flaw

CVE-2026-7011 Overview

A Cross-Site Scripting (XSS) vulnerability has been identified in MaxSite CMS versions up to 109.3. This security weakness affects the Antispam Plugin component, specifically within the file /admin/plugin_antispam. The vulnerability allows remote attackers to execute arbitrary JavaScript code by manipulating the f_logging_file argument due to improper input sanitization.

The vendor has classified this as a "Self-XSS" vulnerability, acknowledging it as a violation of secure coding standards. The lack of proper filtering via htmlspecialchars() allowed malicious data to be rendered without proper escaping, enabling XSS attacks against administrators accessing the plugin configuration.

Critical Impact
Authenticated attackers with administrative privileges can inject malicious scripts through the logging file parameter, potentially leading to session hijacking, credential theft, or unauthorized administrative actions when other administrators view the affected page.

Affected Products

MaxSite CMS versions up to 109.3
MaxSite CMS Antispam Plugin (/admin/plugin_antispam)
Systems using the vulnerable logging file configuration interface

Discovery Timeline

2026-04-26 - CVE-2026-7011 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-7011

Vulnerability Analysis

This stored Cross-Site Scripting vulnerability exists in the MaxSite CMS Antispam Plugin's administrative interface. The vulnerable code path involves the f_logging_file parameter in the plugin's admin configuration page located at /admin/plugin_antispam. When an administrator configures the logging file path, the input value is stored and subsequently rendered without proper HTML encoding.

The core issue stems from the direct output of user-controlled data into an HTML input field's value attribute. Without proper sanitization using PHP's htmlspecialchars() function, an attacker can break out of the attribute context and inject arbitrary JavaScript code. While the vendor has classified this as "Self-XSS" due to the high privilege requirements (administrative access), the vulnerability still represents a deviation from secure coding practices and could be exploited in multi-admin environments or through social engineering.

Root Cause

The root cause is improper output encoding in the Antispam Plugin's admin interface. The $options['logging_file'] variable was directly concatenated into HTML output without sanitization, allowing HTML/JavaScript injection through the f_logging_file form parameter.

The vulnerable code pattern directly embedded user-controlled input into the HTML attribute context:

value="' . $options['logging_file'] . '"

This pattern allows attackers to inject payloads that escape the attribute context using quotes and inject event handlers or script tags.

Attack Vector

The attack requires network access and administrative privileges within MaxSite CMS. An attacker with admin access can:

Navigate to the Antispam Plugin configuration at /admin/plugin_antispam
Enter a malicious payload in the logging file field containing XSS vectors
Save the configuration, storing the malicious input
When any administrator views the configuration page, the injected script executes

The following patch demonstrates the security fix applied in version 109.4:

php

$form .= '<p><strong>' . t('Файл для логов:') . '</strong> ' . getinfo('uploads_dir') . ' <input name="f_logging_file" type="text" value="' . htmlspecialchars($options['logging_file']) . '">';

Source: GitHub Commit 8a3946bd

The fix wraps the $options['logging_file'] value with htmlspecialchars(), ensuring that any HTML special characters are properly encoded before being rendered in the HTML output.

Detection Methods for CVE-2026-7011

Indicators of Compromise

Unusual or suspicious values in the Antispam Plugin's logging file configuration field
Presence of HTML tags, JavaScript event handlers, or script elements in configuration data
Unexpected script execution or browser behavior when accessing /admin/plugin_antispam
Log entries showing modifications to the Antispam Plugin configuration by unexpected users

Detection Strategies

Monitor administrative access logs for requests to /admin/plugin_antispam with suspicious POST parameters
Implement Web Application Firewall (WAF) rules to detect XSS payloads in form submissions
Review stored configuration values for HTML/JavaScript injection patterns
Deploy Content Security Policy (CSP) headers to mitigate script execution from injected content

Monitoring Recommendations

Enable detailed logging for all MaxSite CMS administrative actions
Configure alerts for configuration changes to security-related plugins
Implement periodic audits of stored configuration data for malicious content
Deploy browser-based XSS detection tools for administrative sessions

How to Mitigate CVE-2026-7011

Immediate Actions Required

Upgrade MaxSite CMS to version 109.4 or later immediately
Review Antispam Plugin configuration for any suspicious or unexpected values in the logging file field
Audit administrative user accounts and remove any unauthorized or compromised accounts
Implement Content Security Policy headers to limit script execution sources

Patch Information

MaxSite CMS has released version 109.4 which addresses this vulnerability. The fix is contained in commit 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7. The patch implements proper output encoding using PHP's htmlspecialchars() function to prevent script injection through the logging file parameter.

Patch resources:

Workarounds

Restrict administrative access to trusted users only until the patch can be applied
Implement strict Content Security Policy headers to prevent inline script execution
Use a Web Application Firewall to filter XSS payloads in form submissions
Manually sanitize the logging file configuration value in the database if upgrading is not immediately possible

bash

# Verify MaxSite CMS version after upgrade
grep -r "version = '109" application/libraries/maxsite_lib.php
# Expected output should show version 109.4 or higher