CVE-2026-87928

Name of the Vulnerable Software and Affected Versions MaxSite CMS versions 0.94 through 109.6

Description A stored cross-site scripting issue exists in the admin page upload handler. This flaw allows any authenticated user to upload HTML files containing malicious scripts to the uploads/ pages/ directory. When a visitor accesses these files, the scripts execute within their browser.

Recommendations Update MaxSite CMS to a version later than 109.6. Restrict the ability of users to upload files via the admin page handler as a temporary mitigation.