CVE-2026-87928: Maxsite CMS

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the admin_page upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/_pages/ directory, which executes in visitors' browsers when the file is accessed, enabling persistent stored cross-site scripting attacks.

Affected products

• Maxsite Maxsite CMS: from 0.94, up to and including 109.6

Published 2026-09-09. Last modified 2026-09-18.