Is CVE-2026-87928 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87928 being exploited in the wild.

How severe is CVE-2026-87928?

Medium severity, with a CVSS score of 5.4, published 9 September 2026.

Which products and versions are affected?

MaxSite CMS 0.94 through 109.6.

Is there a fix for CVE-2026-87928?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-87928 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-87928?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87928: MaxSite CMS stored cross-site scripting in admin upload handler

CVE-2026-87928 · Severity: medium · CVSS 5.4 · Published 2026-09-09

MaxSite CMS is a content management system used to build websites and blogs. The admin file upload feature allows authenticated users to upload HTML files with malicious scripts to a publicly accessible directory. When visitors access these uploaded HTML files, the embedded scripts execute in their browsers, enabling attackers to steal session cookies, redirect users to phishing pages, or deface the site.

Quick answers

Is CVE-2026-87928 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87928 being exploited in the wild.
How severe is CVE-2026-87928?: Medium severity, with a CVSS score of 5.4, published 9 September 2026.
Which products and versions are affected?: MaxSite CMS 0.94 through 109.6.
Is there a fix for CVE-2026-87928?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-87928 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-87928?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the admin_page upload handler. The file upload endpoint in application/maxsite/admin/plugins/admin_page/uploads-require-maxsite.php accepts a destination filename from the HTTP header X-Requested-Filename and file content directly from php://input with no validation of content. While an extension allowlist restricts uploads, HTML and HTM files are allowed by default. The referer check is trivial to bypass. An authenticated admin user can upload malicious HTML to the uploads/_pages/ directory, which is then served to all visitors and executes in their browsers. The research indicates that forged admin sessions are possible without credentials via a separate finding. In deployments where PHP execution is enabled in the uploads directory, attackers could achieve remote code execution by uploading PHP files if the allowlist is extended.

Affected products

MaxSite CMS 0.94 through 109.6

Timeline

2026-09-09: disclosed
2026-09-08: advisory: Public GitHub advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.