The SPIP jeux plugin versions earlier than 4.1.1 allow reflected cross‑site scripting. A malicious actor can include arbitrary script code in untrusted request parameters that are incorporated into the output during the pre_propre pipeline. The injected code is then reflected directly into the HTML served to a victim, executing in the victim’s browser and enabling malicious actions such as phishing or cookie theft.

Systems running the SPIP jeux plug‑in with a version earlier than 4.1.1 are vulnerable. The anti‑template pre_propre pipeline in these versions fails to perform proper output encoding before embedding user‑supplied parameters into HTML. The vulnerability is specific to the jeu block rendering within SPIP sites.

The CVSS score of 5.1 indicates moderate severity, while the EPSS score of less than 1 % suggests a very low probability of real‑world exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to craft a URL or input containing malicious payloads that target the index parameters used by the plugin; the reflected script then runs with the victim’s browser privileges, potentially compromising user sessions or data. The risk level remains moderate, but the low exploitation likelihood limits immediate threat unless an attacker actively leverages this vector.