{"id":"CVE-2025-13983","published":"2026-01-28T20:02:09Z","modified":"2026-01-29T17:52:24Z","title":"Tagify - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-121","vendor":"Drupal","product":"Tagify","tier":"tail","description":{"text":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issue affects Tagify: from 0.0.0 before 1.2.44.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00166,"percentile":0.05763,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2025-121","tags":[]}],"priority":{"score":4.9,"factors":[{"name":"EPSS percentile","points":1.15},{"name":"CVSS severity","points":3.78}]},"vendorSlug":"drupal","affectedVersions":[{"vendor":"Drupal","product":"Tagify","versions":[">= 0.0.0, < 1.2.44"]}],"affected":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/tagify","vulnerableRanges":["<1.2.44"],"patched":["1.2.44"],"from":["DRUPAL-CONTRIB-2025-121"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-206438","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-drupal-tagify-cve-2025-13983","packageHistory":[{"cve":"CVE-2025-13983","published":"2026-01-28","fixed":"1.2.44","kev":false},{"cve":"CVE-2026-3212","published":"2026-03-25","fixed":"1.2.49","kev":false,"link":{"from":"CVE-2025-13983","to":"CVE-2026-3212","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:https://packages.drupal.org/8:drupal/tagify","fromFixed":"1.2.44","toFixed":"1.2.49","daysApart":56},{"kind":"similar","provenance":"machine","score":1.0,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2026-11908","published":"2026-07-10","fixed":"1.2.52","kev":false}],"package":"Packagist:https://packages.drupal.org/8:drupal/tagify"}}