SPIP versions prior to 4.4.8 allow malicious code to be injected into the back‑office through iframe tags because the application fails to escape or sandbox iframe content. This cross‑site scripting flaw is identified as CWE‑79 and can enable an attacker to run arbitrary scripts in the context of the private area, potentially exfiltrating credentials, injecting malware, and modifying or deleting content.

The vulnerability affects the SPIP CMS platform for all releases older than 4.4.8. Administrators operating any of those versions are at risk; newer releases incorporate a sandbox attribute on all iframe elements in the private area, eliminating the flaw.

The issue is scored CVSS 5.1, indicating moderate severity, and has an EPSS score of less than 1 % meaning current exploitation activity is expected to be very low. It is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the back‑office, so the attack surface is limited to users with administrative or privileged session rights. Once an attacker is inside the private area, they can craft payloads that exploit the unsanitized iframe tags and run scripts within the site’s context.