What is the CVSS score of CVE-2026-27746?

CVE-2026-27746 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Jeux are affected by CVE-2026-27746?

Organizations using versions should be aware of moderate risk from CVE-2026-27746, a cross-site scripting vulnerability rated CVSS 6.1.. A patch is available.

How to fix or mitigate CVE-2026-27746?

Within 30 days: Identify affected systems running versions and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Jeux CVE-2026-27746

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-02-25 disclosure@vulncheck.com

XSS Jeux

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Feb 27, 2026 - 19:24 nvd

Patch available

CVE Published

Feb 25, 2026 - 04:16 nvd

MEDIUM 6.1

DescriptionCVE.org

The SPIP jeux plugin versions prior to 4.1.1 contain a reflected cross-site scripting (XSS) vulnerability in the pre_propre pipeline. The plugin incorporates untrusted request parameters into HTML output without proper output encoding, allowing attackers to inject arbitrary script content into pages that render a jeux block. When a victim is induced to visit a crafted URL, the injected content is reflected into the response and executed in the victim's browser context.

AnalysisAI

Reflected XSS in SPIP jeux plugin before version 4.1.1 allows unauthenticated remote attackers to inject malicious scripts through unencoded request parameters in the pre_propre pipeline. An attacker can craft a malicious URL that, when visited by a victim, executes arbitrary JavaScript in the victim's browser with access to the page's context. A patch is available for affected installations.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects the incorporates untrusted request component of Jeux. The SPIP jeux plugin versions prior to 4.1.1 contain a reflected cross-site scripting (XSS) vulnerability in the pre_propre pipeline. The plugin incorporates untrusted request parameters into HTML output without proper output encoding, allowing attackers to inject arbitrary script content into pages that render a jeux block. When a victim is induced to visit a crafted URL, the injected content is reflected into the response and executed in the victim's browser context.

RemediationAI

A vendor patch is available — apply it immediately. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.