| Package | Affected versions | Patched versions |
|---|---|---|
| spip | ≥ 4.4.0, < 4.4.9 | 4.4.9 |
SPIP before 4.4.9 allows Stored Cross-Site Scripting (XSS) via syndicated sites in the private area. The #URL_SYNDIC output is not properly sanitized on the private syndicated site page, allowing an attacker who can set a malicious syndication URL to inject persistent scripts that execute when other administrators view the syndicated site details.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free