What’s Vulnerable › Products

MaxSite CMS vulnerabilities

21 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 16 published in the last 12 months.

Check whether your MaxSite CMS version is affected

Latest MaxSite CMS vulnerabilities

• CVE-2026-87930 — MaxSite CMS through 109.6 PHP Object Injection via ci_session (CVSS 8.1)
• CVE-2026-87929 — MaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption Key (CVSS 9.8)
• CVE-2026-87928 — MaxSite CMS 0.94 through 109.6 HTML Upload XSS via admin_page (CVSS 5.4)
• CVE-2026-87927 — MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher (CVSS 8.2)
• CVE-2026-70554 — MaxSite CMS Unauthenticated PHP Object Injection via maxsite_comuser Cookie (CVSS 9.8)
• CVE-2026-70553 — MaxSite CMS Unauthenticated RCE via Install Endpoint (CVSS 9.8)
• CVE-2026-70552 — MaxSite CMS 109.5 Unauthenticated AJAX Dispatcher Bypass via ajax.php (CVSS 9.8)
• CVE-2026-7016 — MaxSite CMS ushki Plugin cross site scripting (CVSS 2.4)
• CVE-2026-7015 — MaxSite CMS Guestbook Plugin cross site scripting (CVSS 2.4)
• CVE-2026-7014 — MaxSite CMS down_count Plugin cross site scripting (CVSS 2.4)
• CVE-2026-7013 — MaxSite CMS mail_send Plugin cross site scripting (CVSS 2.4)
• CVE-2026-7012 — MaxSite CMS Redirect Plugin cross site scripting (CVSS 2.4)
• CVE-2026-7011 — MaxSite CMS Antispam Plugin plugin_antispam cross site scripting (CVSS 2.4)
• CVE-2026-3395 — MaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection (CVSS 9.8)
• CVE-2025-12347 — MaxSite CMS save-file-ajax.php unrestricted upload (CVSS 8.8)
• CVE-2025-12346 — MaxSite CMS HTTP Header uploads-require-maxsite.php unrestricted upload (CVSS 8.8)
• CVE-2022-25413 — (CVSS 5.4)
• CVE-2022-25412 — (CVSS 8.1)
• CVE-2022-25411 — (CVSS 9.8)
• CVE-2022-25410 — (CVSS 5.4)
• CVE-2021-27983 — (CVSS 9.8)