CVE-2026-26223
Stored Cross-Site Scripting in SPIP Private Area via Iframes
Publication date: 2026-02-19
Last updated on: 2026-03-02
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| spip | spip | From 4.4.0 (inc) to 4.4.8 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects SPIP versions before 4.4.8 and allows Cross-Site Scripting (XSS) attacks in the private area of the application. It occurs because the application does not properly sandbox or escape iframe content in the back-office, which enables an attacker to inject and execute malicious scripts via malicious iframe tags.
The issue is addressed by adding a sandbox attribute to iframe tags in the private area to prevent such script execution.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can inject and execute malicious scripts within the private area of the SPIP application. This can lead to unauthorized actions such as stealing sensitive information, hijacking user sessions, or performing actions on behalf of legitimate users.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade SPIP to version 4.4.8 or later, where the issue is fixed by adding a sandbox attribute to iframe tags in the private area.
Since the vulnerability is not mitigated by the SPIP security screen, relying on that is insufficient.