SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability in ecrire/public/interfaces.php adding the function safehtml to the vulnerable fields. An editor is able to modify his personal information. If the editor has an article written and available when a user goes to the public site and wants to read the author's information the malicious code will be executed. The \Who are you\ and \Website Name\ fields are vulnerable.