Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The SPIP jeux plugin versions prior to 4.1.1 contain a reflected cross-site scripting (XSS) vulnerability in the pre_propre pipeline. The plugin incorporates untrusted request parameters into HTML output without proper output encoding, allowing attackers to inject arbitrary script content into pages that render a jeux block. When a victim is induced to visit a crafted URL, the injected content is reflected into the response and executed in the victim's browser context.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-27746 Reflected Cross-Site Scripting in SPIP Jeux Plugin Pre-4.1.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27746
Post summary
The post announces a reflected XSS vulnerability (CVE‑2026‑27746) affecting SPIP Jeux Plugin versions prior to 4.1.1, as listed on Vulmon.
CVE-2026-27746 The SPIP jeux plugin versions prior to 4.1.1 contain a reflected cross-site scripting (XSS) vulnerability in the pre_propre pipeline. The plugin incorporates untruste… https://www.cve.org/CVERecord?id=CVE-2026-27746
Post summary
CVE-2026-27746 reveals a reflected cross‑site scripting flaw in SPIP jeux plugin versions before 4.1.1, affecting the pre_propre pipeline. No PoC, exploit, or patch details are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | spip | jeux | - | - | - |