CVE-2026-7013

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7013", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-25T10:13:26.890Z", "datePublished": "2026-04-26T02:00:20.341Z", "dateUpdated": "2026-04-27T12:41:59.493Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-26T02:00:20.341Z"}, "title": "MaxSite CMS mail_send Plugin cross site scripting", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "Cross Site Scripting"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}], "affected": [{"vendor": "MaxSite", "product": "CMS", "versions": [{"version": "109.0", "status": "affected"}, {"version": "109.1", "status": "affected"}, {"version": "109.2", "status": "affected"}, {"version": "109.3", "status": "affected"}, {"version": "109.4", "status": "unaffected"}], "modules": ["mail_send Plugin"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in MaxSite CMS up to 109.3. Affected by this issue is some unknown functionality of the component mail_send Plugin. The manipulation of the argument f_subject/f_files/f_from leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 109.4 can resolve this issue. The identifier of the patch is 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7. It is advisable to upgrade the affected component. The vendor was informed early about this issue. They classify it as a \"Self-XSS\". They deployed a countermeasure: \"Nevertheless, we consider this a violation of secure coding standards. The lack of filtering via `htmlspecialchars()` has already been fixed in the latest patch to prevent incorrect data display.\""}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 2.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 2.4, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 3.3, "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-04-25T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-25T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-25T12:19:05.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "konchan (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/359592", "name": "VDB-359592 | MaxSite CMS mail_send Plugin cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359592/cti", "name": "VDB-359592 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/796738", "name": "Submit #796738 | MaxSite CMS 109.3 Cross Site Scripting", "tags": ["third-party-advisory"]}, {"url": "https://github.com/wnaspy/CVE/blob/main/Report-%20Stored%20XSS-in-mail_send-plugin-maxsite-cms.pdf.pdf", "tags": ["exploit"]}, {"url": "https://github.com/maxsite/cms/commit/8a3946bd0a54bfb72a4d57179fcd253f2c550cd7", "tags": ["patch"]}, {"url": "https://github.com/maxsite/cms/releases/tag/v109", "tags": ["patch"]}, {"url": "https://github.com/maxsite/cms/", "tags": ["product"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-27T12:41:47.766600Z", "id": "CVE-2026-7013", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T12:41:59.493Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"tags": ["x_open-source"], "title": "MaxSite CMS mail_send Plugin cross site scripting", "credits": [{"lang": "en", "type": "reporter", "value": "konchan (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 2.4, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 2.4, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 3.3, "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:OF/RC:C"}}], "affected": [{"vendor": "MaxSite", "modules": ["mail_send Plugin"], "product": "CMS", "versions": [{"status": "affected", "version": "109.0"}, {"status": "affected", "version": "109.1"}, {"status": "affected", "version": "109.2"}, {"status": "affected", "version": "109.3"}, {"status": "unaffected", "version": "109.4"}]}], "timeline": [{"lang": "en", "time": "2026-04-25T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-25T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-25T12:19:05.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/359592", "name": "VDB-359592 | MaxSite CMS mail_send Plugin cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359592/cti", "name": "VDB-359592 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/796738", "name": "Submit #796738 | MaxSite CMS 109.3 Cross Site Scripting", "tags": ["third-party-advisory"]}, {"url": "https://github.com/wnaspy/CVE/blob/main/Report-%20Stored%20XSS-in-mail_send-plugin-maxsite-cms.pdf.pdf", "tags": ["exploit"]}, {"url": "https://github.com/maxsite/cms/commit/8a3946bd0a54bfb72a4d57179fcd253f2c550cd7", "tags": ["patch"]}, {"url": "https://github.com/maxsite/cms/releases/tag/v109", "tags": ["patch"]}, {"url": "https://github.com/maxsite/cms/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in MaxSite CMS up to 109.3. Affected by this issue is some unknown functionality of the component mail_send Plugin. The manipulation of the argument f_subject/f_files/f_from leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 109.4 can resolve this issue. The identifier of the patch is 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7. It is advisable to upgrade the affected component. The vendor was informed early about this issue. They classify it as a \"Self-XSS\". They deployed a countermeasure: \"Nevertheless, we consider this a violation of secure coding standards. The lack of filtering via `htmlspecialchars()` has already been fixed in the latest patch to prevent incorrect data display.\""}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Cross Site Scripting"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Code Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-26T02:00:20.341Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7013", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-27T12:41:47.766600Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-04-27T12:41:52.873Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-7013", "state": "PUBLISHED", "dateUpdated": "2026-04-26T02:00:20.341Z", "dateReserved": "2026-04-25T10:13:26.890Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-26T02:00:20.341Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["mail_send Plugin"], "product": "CMS", "vendor": "MaxSite", "versions": [{"status": "affected", "version": "109.0"}, {"status": "affected", "version": "109.1"}, {"status": "affected", "version": "109.2"}, {"status": "affected", "version": "109.3"}, {"status": "unaffected", "version": "109.4"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in MaxSite CMS up to 109.3. Affected by this issue is some unknown functionality of the component mail_send Plugin. The manipulation of the argument f_subject/f_files/f_from leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 109.4 can resolve this issue. The identifier of the patch is 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7. It is advisable to upgrade the affected component. The vendor was informed early about this issue. They classify it as a \"Self-XSS\". They deployed a countermeasure: \"Nevertheless, we consider this a violation of secure coding standards. The lack of filtering via `htmlspecialchars()` has already been fixed in the latest patch to prevent incorrect data display.\""}, {"lang": "es", "value": "Una vulnerabilidad de seguridad ha sido detectada en MaxSite CMS hasta 109.3. Afectada por este problema es alguna funcionalidad desconocida del componente plugin mail_send. La manipulaci\u00f3n del argumento f_subject/f_files/f_from lleva a cross site scripting. El ataque puede ser iniciado remotamente. El exploit ha sido divulgado p\u00fablicamente y puede ser usado. Actualizar a la versi\u00f3n 109.4 puede resolver este problema. El identificador del parche es 8a3946bd0a54bfb72a4d57179fcd253f2c550cd7. Es aconsejable actualizar el componente afectado. El proveedor fue informado tempranamente sobre este problema. Lo clasifican como un \u2019Self-XSS\u2019. Desplegaron una contramedida: \u2019Sin embargo, consideramos esto una violaci\u00f3n de los est\u00e1ndares de codificaci\u00f3n segura. La falta de filtrado v\u00eda \u201chtmlspecialchars()\u201d ya ha sido corregida en el \u00faltimo parche para prevenir la visualizaci\u00f3n incorrecta de datos.\u2019"}], "id": "CVE-2026-7013", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "MULTIPLE", "availabilityImpact": "NONE", "baseScore": 3.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.4, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.4, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7013", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-27T12:41:47.766600Z", "version": "2.0.3"}}]}, "published": "2026-04-26T03:16:00.153", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/maxsite/cms/"}, {"source": "cna@vuldb.com", "url": "https://github.com/maxsite/cms/commit/8a3946bd0a54bfb72a4d57179fcd253f2c550cd7"}, {"source": "cna@vuldb.com", "url": "https://github.com/maxsite/cms/releases/tag/v109"}, {"source": "cna@vuldb.com", "url": "https://github.com/wnaspy/CVE/blob/main/Report-%20Stored%20XSS-in-mail_send-plugin-maxsite-cms.pdf.pdf"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/796738"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359592"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359592/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "109.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "109.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "109.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "109.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "109.4"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "CMS", "source": "cna", "vendor": "MaxSite"}, "product": "cms", "vendor": "maxsite"}], "analysis": {"en": {"generated_at": "2026-04-28T05:26:52.095194+00:00", "value": {"mitigation_remediation": ["Apply the vendor patch to MaxSite CMS version\u00a0109.4, which updates the mail_send plugin to use htmlspecialchars() on all output.", "If an immediate upgrade is not possible, modify the mail_send code to wrap the f_subject, f_from, and f_files values with htmlspecialchars() before rendering them to the browser.", "Conduct a targeted XSS test against the mail_send endpoint to confirm that arbitrary script payloads are no longer executed, and revise the test matrix as new plugins or fields are added."], "summary": {"action": "Patch", "impact": "Cross\u2011site scripting"}, "threat_synthesis": {"affected_systems": "MaxSite CMS (MaxSite:CMS) versions up to 109.3 are affected, specifically the mail_send component which accepts the f_subject, f_files, and f_from parameters. Installing the patch released in version\u00a0109.4 (commit\u00a08a3946bd0a54bfb72a4d57179fcd253f2c550cd7) removes the flaw by adding the necessary output sanitization.", "description_and_impact": "A flaw exists in the mail_send plugin of MaxSite CMS through version\u00a0109.3 that allows an attacker to embed arbitrary JavaScript into the f_subject, f_files, or f_from fields. The injected code is rendered in browsers without proper output encoding, creating a stored cross\u2011site scripting (XSS) vector. The vendor classifies it as a Self\u2011XSS issue and notes that the lack of htmlspecialchars() filtering caused the vulnerability.", "risk_and_exploitability": "The CVSS score of 4.8 indicates moderate severity, while the EPSS score is below 1\u202f% and the vulnerability is not listed in the CISA KEV catalog, suggesting a low current exploitation probability. The attack is remotely accessible; an adversary only needs to submit a crafted request to the mail_send endpoint, after which the malicious script is stored and executed for any user who views the content. Public disclosure is available, so unpatched installations remain susceptible to repeated exploitation by anyone with network access to the CMS."}}}}, "created": "2026-04-27T18:41:59.099486+00:00", "updated": "2026-04-28T05:30:23.367389+00:00", "vendors": ["maxsite", "maxsite$PRODUCT$cms"]}