A stored cross‑site scripting vulnerability exists in SPIP versions prior to 4.4.9. The syndication URL that appears on the private syndicated site page is not properly sanitized, permitting an attacker to inject malicious scripts into the #URL_SYNDIC output. When an administrator later opens the syndicated site details, the injected scripts are executed in their browser, potentially delivering persistent client‑side code to that user.

The affected product is SPIP; all releases older than 4.4.9 are vulnerable. No specific patches or sub‑versions are listed beyond the version threshold, so any installation running a pre‑4.4.9 release may be affected.

The CVSS base score of 5.1 indicates moderate risk. The EPSS score of less than 1% suggests that exploitation attempts are expected to be rare. The vulnerability is not listed in the CISA KEV catalog. The attack vector requires the attacker to have the ability to set or modify a syndicated site URL, which generally implies administrative or privileged access. Once the malicious URL is in place, any administrator who views the syndicated site detail page will have the injected scripts executed in their browser.