Drupal Tagify CVE-2026-11908

Exploitation requires an authenticated user account holding a Drupal role with permission to create or edit content that uses a Tagify-widget field (PR:L per CVSS vector). The Tagify module must be installed, enabled, and configured on at least one content type or field on the target Drupal site - this is a non-default, explicitly installed contributed module. A victim must subsequently load the page containing the poisoned tag data in their browser (UI:R). Limiting factors: authentication is required for payload injection; the Tagify module is not present in default Drupal installations; victims must actively browse to the affected content. Sites that restrict content creation to fully trusted administrators with no untrusted editor roles are not realistically exposed despite the network-reachable attack vector.

The CVSS 5.4 Medium score is consistent with a network-reachable (AV:N), low-complexity (AC:L) stored XSS requiring low privilege to submit (PR:L) and user interaction from a victim (UI:R), with Changed scope (S:C) and limited confidentiality and integrity impact (C:L/I:L). EPSS at 0.16% (6th percentile) reflects a very low empirical exploitation probability, and there is no CISA KEV listing and no reported public proof-of-concept - these signals together indicate this is not currently being targeted at scale. Despite the moderate CVSS score, stored XSS carries higher real-world risk than reflected XSS because payloads self-propagate to all viewers, including privileged administrators, without requiring a separate phishing step. The actual risk is bounded by deployment footprint: Tagify is a non-core contributed module not present in default Drupal installations, substantially limiting the exposed population. Organizations with untrusted editors capable of submitting tagged content represent the primary risk group.

An authenticated user with a low-privilege role - such as a registered site member or content contributor - submits a crafted JavaScript payload embedded in a Tagify tag field on a content creation or editing form. The payload is persisted to the Drupal database. When any subsequent user, including a site administrator, navigates to the affected content page, the stored script executes in their browser, enabling session token theft, credential harvesting, or unauthorized actions performed in the victim's authenticated context. No public exploit code has been identified at the time of analysis.