CVE-2026-7013: MaxSite CMS mail_send Plugin XSS Flaw

CVE-2026-7013 Overview

A Cross-Site Scripting (XSS) vulnerability has been identified in MaxSite CMS versions up to 109.3. The vulnerability affects the mail_send plugin component, where improper input validation of the f_subject, f_files, and f_from arguments allows for XSS attacks. The vulnerability can be exploited remotely and has been publicly disclosed with available exploit information.

Critical Impact

Attackers can inject malicious scripts through the mail_send plugin parameters, potentially allowing session hijacking, credential theft, or defacement within the context of the affected CMS installation.

Affected Products

• MaxSite CMS up to version 109.3
• MaxSite CMS mail_send plugin component
• Web applications utilizing vulnerable MaxSite CMS installations

Discovery Timeline

• 2026-04-26 - CVE-2026-7013 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-7013

Vulnerability Analysis

This vulnerability stems from insufficient input sanitization within the mail_send plugin of MaxSite CMS. The affected component fails to properly encode user-supplied input through the f_subject, f_files, and f_from parameters before rendering them in the HTML output. Without proper escaping using functions like htmlspecialchars(), malicious JavaScript code embedded in these parameters can be executed in the context of the victim's browser session.

The vendor has acknowledged this as a "Self-XSS" vulnerability, indicating that user interaction is required for exploitation. While Self-XSS typically requires the victim to perform specific actions, it still represents a violation of secure coding standards and can be leveraged in social engineering attacks or chained with other vulnerabilities for greater impact.

Root Cause

The root cause of CVE-2026-7013 is the absence of proper output encoding when displaying user-controlled input values. Specifically, the vulnerable code paths did not utilize htmlspecialchars() or equivalent sanitization functions when rendering the f_subject, f_files, and f_from parameters in HTML contexts. This missing security control allows specially crafted input containing JavaScript to be interpreted as executable code rather than display text.

Attack Vector

The attack vector is network-based, allowing remote exploitation. An attacker can craft malicious input containing JavaScript payloads and submit it through the affected mail_send plugin parameters. When the application renders this data without proper encoding, the malicious script executes in the victim's browser. The attack requires privileged access and user interaction, as indicated by the vendor's Self-XSS classification.

The following patches demonstrate the security fix applied in version 109.4:

// Security patch in application/maxsite/plugins/antispam/admin.php - MaxSite CMS 109.4
 		$chk = $options['moderation_links'] ? ' checked="checked"  ' : '';
 		$form .= '<p><label><input name="f_moderation_links" type="checkbox" ' . $chk . '> <strong>' . t('Отправлять комментарий на модерацию, если в нем встречается хоть одна ссылка.') . '</strong></label>';
 		
-		$form .= '<p><strong>' . t('Файл для логов:') . '</strong> ' . getinfo('uploads_dir') . ' <input name="f_logging_file" type="text" value="' . $options['logging_file'] . '">';
+		$form .= '<p><strong>' . t('Файл для логов:') . '</strong> ' . getinfo('uploads_dir') . ' <input name="f_logging_file" type="text" value="' . htmlspecialchars($options['logging_file']) . '">';
 		if (file_exists( getinfo('uploads_dir') . $options['logging_file'] ))
 			$form .= ' <a href="' . getinfo('uploads_url') . $options['logging_file'] . '" target="_blank">' . t('Посмотреть') . '</a>';

Source: GitHub Commit Details

The fix adds the htmlspecialchars() function call to properly encode user-supplied values before inserting them into HTML attributes, preventing script injection.

Detection Methods for CVE-2026-7013

Indicators of Compromise

• Suspicious JavaScript code fragments in f_subject, f_files, or f_from form parameters submitted to the mail_send plugin
• Unusual <script> tags or event handler attributes (e.g., onerror, onclick) appearing in mail-related form submissions
• Web application firewall logs showing XSS attack patterns targeting MaxSite CMS endpoints
• Browser console errors indicating blocked or executed inline scripts from unexpected sources

Detection Strategies

• Deploy web application firewall (WAF) rules to detect XSS payloads in HTTP request parameters, particularly targeting f_subject, f_files, and f_from fields
• Implement Content Security Policy (CSP) headers to mitigate the impact of successful XSS attacks and generate violation reports
• Monitor server logs for requests containing encoded or obfuscated JavaScript patterns in form submissions
• Utilize SentinelOne Singularity to detect anomalous browser behavior and script execution patterns indicative of XSS exploitation

Monitoring Recommendations

• Enable verbose logging for the MaxSite CMS mail_send plugin to capture all form submission data for security analysis
• Configure real-time alerting for CSP violation reports that may indicate XSS exploitation attempts
• Review web server access logs periodically for unusual patterns in requests to mail-related CMS endpoints

How to Mitigate CVE-2026-7013

Immediate Actions Required

• Upgrade MaxSite CMS to version 109.4 or later immediately to apply the security patch
• Review all instances of MaxSite CMS deployments within your organization to identify vulnerable installations
• Implement Web Application Firewall (WAF) rules to block common XSS attack patterns as an interim measure
• Enable Content Security Policy headers to reduce the impact of potential XSS attacks

Patch Information

The MaxSite CMS development team has addressed this vulnerability in version 109.4. The patch with commit hash 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7 adds proper HTML encoding using htmlspecialchars() to prevent incorrect data display and script injection. For detailed patch information, refer to the GitHub Commit Details and the GitHub Release v109.

Workarounds

• If immediate patching is not possible, consider disabling or restricting access to the mail_send plugin until the update can be applied
• Implement input validation at the web server or reverse proxy level to sanitize potentially malicious characters before they reach the application
• Restrict access to the CMS administrative interfaces to trusted IP addresses only

# Configuration example - Apache mod_security rule to block XSS in mail_send parameters
SecRule ARGS:f_subject|ARGS:f_files|ARGS:f_from "@detectXSS" \
    "id:1001,phase:2,deny,status:403,msg:'XSS Attack Blocked in mail_send'"