CVE-2026-87928

MEDIUM 5.4

MaxSite CMS 0.94 through 109.6 HTML Upload XSS via admin_page

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the admin_page upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/_pages/ directory, which executes in visitors' browsers when the file is accessed, enabling persistent stored cross-site scripting attacks.

CWE	CWE-434
Vendor	maxsite
Product	maxsite cms
Published	Sep 9, 2026

Stay Ahead of the Next One

Get instant alerts for maxsite maxsite cms

Be the first to know when new medium vulnerabilities affecting maxsite maxsite cms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

MaxSite / MaxSite CMS

0.94 ≤ 109.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/maxsite/cms github.com: https://github.com/EviL0rd/maxsite-cve2/blob/main/2026.09.08-maxsite-cms-arbitrary-file-write-stored-xss.md github.com: https://github.com/maxsite/cms/blob/2ca0a0c7d1d71106a25dbb0f2aedaaefbf12802c/application/maxsite/admin/plugins/admin_page/uploads-require-maxsite.php#L1-L64 vulncheck.com: https://www.vulncheck.com/advisories/maxsite-cms-0.94-through-109.6-html-upload-xss-via-admin-page

Credits

🔍 EVIL0RD