CVE-2026-7013 Overview
CVE-2026-7013 is a stored cross-site scripting (XSS) vulnerability affecting MaxSite CMS versions up to and including 109.3. The flaw resides in the mail_send plugin component, where the f_subject, f_files, and f_from parameters lack proper output sanitization. An authenticated attacker with high privileges can inject malicious script content that executes in a browser context when the data is rendered. The vendor classifies the issue as a Self-XSS but has acknowledged it as a violation of secure coding standards. The exploit has been publicly disclosed, and the fix is tracked under commit 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7, included in version 109.4.
Critical Impact
Authenticated attackers can inject persistent JavaScript through the mail_send plugin, leading to script execution in administrator browsers when the affected fields are displayed.
Affected Products
- MaxSite CMS versions up to and including 109.3
- MaxSite CMS mail_send plugin component
- Fixed in MaxSite CMS version 109.4
Discovery Timeline
- 2026-04-26 - CVE-2026-7013 published to NVD
- 2026-04-29 - Last updated in NVD database
Technical Details for CVE-2026-7013
Vulnerability Analysis
The vulnerability is a stored cross-site scripting flaw [CWE-79] in the mail_send plugin shipped with MaxSite CMS. User-supplied values for f_subject, f_files, and f_from are processed without HTML-context escaping. When these values are later rendered in the administrative interface, attacker-controlled markup executes as JavaScript in the browser session of the viewing user. The vendor has fixed the issue by introducing htmlspecialchars() filtering on the affected fields. Although MaxSite classifies the condition as a Self-XSS due to the high privilege requirement, the underlying defect is a missing output-encoding step that violates standard secure coding practice.
Root Cause
The root cause is the absence of HTML entity encoding on user-controlled input prior to rendering. The mail_send plugin trusted the f_subject, f_files, and f_from parameters and emitted them directly into HTML output. Without htmlspecialchars() or an equivalent sanitization routine, characters such as <, >, and " were preserved verbatim, allowing script tags or event-handler attributes to be parsed and executed by the browser.
Attack Vector
Exploitation requires network access to the MaxSite CMS administrative interface and authentication with high privileges. An attacker submits a crafted payload to the mail_send plugin in one of the three vulnerable parameters. The injected content persists in the backend store and is later rendered without escaping. User interaction is required for the payload to trigger, which contributes to the low CVSS rating. Public exploitation details have been disclosed through VulDB entry 359592 and the associated GitHub CVE Report - Stored XSS.
No verified proof-of-concept code is published in this advisory. Refer to the GitHub Commit 8a3946b for the precise lines modified to remediate the issue.
Detection Methods for CVE-2026-7013
Indicators of Compromise
- Stored values in the mail_send plugin data containing HTML tags such as <script>, <img onerror=>, or <svg onload=> within the f_subject, f_files, or f_from fields.
- Administrative audit log entries showing modifications to mail_send plugin records from unexpected accounts.
- Browser console errors or unexpected outbound requests originating from administrator sessions when viewing mail-send records.
Detection Strategies
- Inspect MaxSite CMS database tables and configuration files for mail_send records containing angle brackets or JavaScript event handlers.
- Compare the deployed plugin source against commit 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7 to confirm the htmlspecialchars() fix is present.
- Review web server access logs for POST requests targeting the mail_send plugin endpoint that include script-like payloads in form parameters.
Monitoring Recommendations
- Enable Content Security Policy (CSP) reporting to capture inline script execution attempts in the admin panel.
- Monitor authentication logs for high-privilege account anomalies, since exploitation requires PR:H access.
- Alert on changes to plugin files and database rows associated with the mail_send component.
How to Mitigate CVE-2026-7013
Immediate Actions Required
- Upgrade MaxSite CMS to version 109.4 or later, which contains the official patch.
- Audit existing mail_send plugin records for any stored payloads containing HTML or JavaScript and remove malicious entries.
- Rotate credentials of any high-privilege accounts that may have been used to inject payloads.
Patch Information
The vendor released the fix in MaxSite CMS version 109.4. The patch is identified by commit 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7 and applies htmlspecialchars() filtering to the affected fields. Source references include the GitHub CMS Repository and the GitHub Release v109.
Workarounds
- Restrict access to the MaxSite CMS administrative interface to trusted IP ranges until patching is complete.
- Enforce least-privilege role assignments so that only essential accounts can modify the mail_send plugin.
- Deploy a web application firewall rule that blocks HTML tags and JavaScript event handlers in f_subject, f_files, and f_from parameters.
# Configuration example: upgrade MaxSite CMS to the patched release
cd /var/www/maxsite-cms
git fetch --tags
git checkout v109.4
# Verify the fix commit is present
git log --oneline | grep 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
