CVE-2026-26223

SPIP < 4.4.8 Cross-Site Scripting via Iframe Tags in Private Area

Medium · published February 19, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
33.3
In the wild
Unconfirmed
What it is

SPIP before 4.4.8 allows cross-site scripting (XSS) in the private area via malicious iframe tags. The application does not properly sandbox or escape iframe content in the back-office, allowing an attacker to inject and execute malicious scripts. The fix adds a sandbox attribute to iframe tags in the private area. This vulnerability is not mitigated by the SPIP security screen.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00402 · 33.3th percentile
Published
2026-02-19T15:26Z
EPSS history
Timeline
  • 19 FEB 15:26Z
    SPIP < 4.4.8 Cross-Site Scripting via Iframe Tags in Private Area
    cvelistv5