Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.8
SPIP 4.2.14 and Earlier: Malicious Scripts Can Run in Browsers
CVE-2025-71240
Summary
If you use SPIP version 4.2.14 or earlier, a hacker could inject malicious code into your website that runs in visitors' browsers, potentially stealing data or taking control of their sessions. To fix this, update to version 4.2.15 or later.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| spip | spip | > 4.2.0 , <= 4.2.15 | – |
Original title
SPIP before 4.2.15 allows Cross-Site Scripting (XSS) via crafted content in HTML code tags. The application does not properly verify JavaScript within code tags, allowing an attacker to inject mali...
Original description
SPIP before 4.2.15 allows Cross-Site Scripting (XSS) via crafted content in HTML code tags. The application does not properly verify JavaScript within code tags, allowing an attacker to inject malicious scripts that execute in a victim's browser.
nvd CVSS3.1
5.4
nvd CVSS4.0
4.8
Vulnerability type
CWE-79
Cross-site Scripting (XSS)
Published: 19 Feb 2026 · Updated: 11 Mar 2026 · First seen: 6 Mar 2026