CVE-2026-11908CWE-79cross-site-scripting

CVE-2026-11908

Medium · published July 11, 2026

CVSS v3.1

5.4

EPSS

Percentile

12.9

In the wild

Unconfirmed

What it is

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Stored XSS. This issue affects Tagify versions: from 0.0.0 to 1.2.52.

The record

Technical detail

CVSS v3.1: 5.4 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00228 · 12.9th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2026-07-11T02:16Z

Affected products (1)

Product	Versions	Fixed in
factorial/tagify	< 1.2.52	1.2.52

References (1)

https://www.drupal.org/sa-contrib-2026-043 · [email protected]

EPSS history

Timeline

10 JUL 21:43Z
Tagify - Moderately critical - Cross-site scripting (XSS) - SA-CONTRIB-2026-043
cvelistv5