CVE-2026-27473: Spip

Medium severity, CVSS 6.4. EPSS: 0.3% chance of exploitation in the next 30 days.

SPIP before 4.4.9 allows Stored Cross-Site Scripting (XSS) via syndicated sites in the private area. The #URL_SYNDIC output is not properly sanitized on the private syndicated site page, allowing an attacker who can set a malicious syndication URL to inject persistent scripts that execute when other administrators view the syndicated site details.

Affected products

• Spip Spip: from 4.4.0, before 4.4.9 (fixed in 4.4.9)

Published 2026-02-19. Last modified 2026-06-17.