CVE-2026-27473

Medium CVSS: 5.1

SPIP before 4.4.9 allows Stored Cross-Site Scripting (XSS) via syndicated sites in the private area. The #URL_SYNDIC output is not properly sanitized on the private syndicated site page, allowing an attacker who can set a malicious syndication URL to inject persistent scripts that execute when other administrators view the syndicated site details.

Vendor

Spip

Product

Spip

CWE

CWE-79

Yayın Tarihi

2026-02-19 19:22:30

Güncelleme

2026-02-24 19:44:24

Source Identifier

disclosure@vulncheck.com

KEV Date Added

Kategoriler

CWE-79 Spip MEDIUM Spip 2026

Referanslar

https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-9.html https://git.spip.net/spip/spip https://www.vulncheck.com/advisories/spip-stored-cross-site-scripting-via-syndicated-sites

Benzer Kayıtlar

High

CVE-2026-22205

SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows una…

High

CVE-2026-22206

SPIP versions prior to 4.4.10 contain a SQL injection vulnerability that allows authenticated low-privilege users to exe…

High

CVE-2026-27745

The SPIP interface_traduction_objets plugin versions prior to 2.2.2 contain an authenticated remote code execution vulne…

Medium

CVE-2026-27746

The SPIP jeux plugin versions prior to 4.1.1 contain a reflected cross-site scripting (XSS) vulnerability in the pre_pro…

High

CVE-2026-27747

The SPIP interface_traduction_objets plugin versions prior to 2.2.2 contain an authenticated SQL injection vulnerability…

Critical

CVE-2026-27743

The SPIP referer_spam plugin versions prior to 1.3.0 contain an unauthenticated SQL injection vulnerability in the refer…