This vulnerability is a stored cross‑site scripting flaw in the echapper_html_suspect() function of SPIP versions prior to 4.4.8. The function fails to properly escape user‑controlled content, allowing an authenticated user with content‑editing privileges to inject JavaScript that is later rendered on multiple pages. When executed, the payload runs in the victim’s browser context, enabling the attacker to perform actions with that user’s permissions, including unauthorized modification of application state. The weakness is classified as CWE‑79.

The flaw affects all SPIP installations using a version older than 4.4.8. Administrators, authors, and other users with editing rights are capable of crafting the malicious input that will be stored and later displayed in the public portion of the site. Older releases of SPIP that have not applied the 4.4.8 security update remain vulnerable.

The CVSS score of 8.6 indicates a high severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, and it requires legitimate authenticated access with editing rights. Exploitation still demands that the attacker be able to author content that will be publicly displayed, after which the script executes in the context of any viewer, including administrators. The combination of a high CVSS score and the limited attack surface implies that while the potential impact is serious, the likelihood of widespread exploitation remains modest.