Medium severity6.1NVD Advisory· Published Feb 19, 2026· Updated Jun 17, 2026

CVE-2025-71241

Description

SPIP before 4.3.6, 4.2.17, and 4.1.20 allows Cross-Site Scripting (XSS) in the private area. The content of the error message displayed by the 'transmettre' API is not properly sanitized, allowing an attacker to inject malicious scripts. This vulnerability is mitigated by the SPIP security screen.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Spip/Spip3 versions
cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:*range: >=4.1.0,<4.1.20
- (no CPE)range: <4.3.6, 4.2.17, and 4.1.20
- (no CPE)range: 4.1.0

Patches

Vulnerability mechanics

References

blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-3-6-SPIP-4-2-17-SPIP-4-1-20.htmlnvdRelease NotesVendor Advisory
www.vulncheck.com/advisories/spip-cross-site-scripting-in-private-areanvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000