CVE-2026-87928

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the admin_page upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/_pages/ directory, which executes in visitors' browsers when the file is accessed, enabling persistent stored cross-site scripting attacks.

  • Published Sep 9, 2026
  • CVSS 5.1 medium
  • 0.3% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-87928 at the National Vulnerability Database