CVE-2026-27474

SPIP < 4.4.9 Cross-Site Scripting in Private Area (Incomplete Fix)

Medium · published February 19, 2026

CVSS v4.0
4.8
EPSS
0%
Percentile
33.3
In the wild
Unconfirmed
What it is

SPIP before 4.4.9 allows Cross-Site Scripting (XSS) in the private area, complementing an incomplete fix from SPIP 4.4.8. The echappe_anti_xss() function was not systematically applied to input, form, button, and anchor (a) HTML tags, allowing an attacker to inject malicious scripts through these elements. This vulnerability is not mitigated by the SPIP security screen.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00402 · 33.3th percentile
Published
2026-02-19T18:38Z
EPSS history
Timeline
  • 19 FEB 18:38Z
    SPIP < 4.4.9 Cross-Site Scripting in Private Area (Incomplete Fix)
    cvelistv5