SPIP Jeux Plugin Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the SPIP jeux plugin, affecting versions prior to 4.1.1. The issue arises in the pre_propre pipeline, where untrusted request parameters are incorporated into HTML output without adequate encoding. This flaw allows attackers to inject arbitrary scripts into pages that display a jeux block. When a victim visits a crafted URL, the injected script is executed in their browser context.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where injected scripts are executed in the context of the user's browser.

Remediation

Users can update to SPIP jeux version 4.1.1 or later to address this vulnerability.