What is the CVSS score of CVE-2026-3212?

CVE-2026-3212 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Drupal are affected by CVE-2026-3212?

CVE-2026-3212 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 5.4. Attackers could inject scripts to steal sessions or perform actions as authenticated users.. A patch is available.

How to fix or mitigate CVE-2026-3212?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Drupal CVE-2026-3212

EUVD-2026-15469 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-25 drupal

XSS Drupal

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 25, 2026 - 15:46 euvd

EUVD-2026-15469

Analysis Generated

Mar 25, 2026 - 15:46 vuln.today

CVE Published

Mar 25, 2026 - 15:22 nvd

MEDIUM 5.4

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issue affects Tagify: from 0.0.0 before 1.2.49.

AnalysisAI

A Cross-Site Scripting (XSS) vulnerability exists in Drupal Tagify module versions prior to 1.2.49, stemming from improper neutralization of user input during web page generation. An attacker can inject malicious scripts that execute in the context of other users' browsers, potentially leading to session hijacking, credential theft, or malware distribution. This vulnerability affects all Tagify installations from version 0.0.0 through 1.2.48, and patch availability has been confirmed through the Drupal security advisory.

Technical ContextAI

Drupal Tagify (CPE: cpe:2.3:a:drupal:tagify:*:*:*:*:*:*:*:*) is a Drupal module providing tag input functionality for web forms. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), which is a classic reflected or stored XSS flaw. The root cause involves the module failing to properly sanitize or escape user-supplied input before rendering it in HTML contexts, allowing attackers to inject arbitrary JavaScript code. This occurs within the tag rendering pipeline where user-controlled tag values are output to the DOM without sufficient HTML entity encoding or Content Security Policy enforcement.

RemediationAI

Immediately upgrade Drupal Tagify to version 1.2.49 or later, following the patching guidance in the official Drupal security advisory at https://www.drupal.org/sa-contrib-2026-013. For installations where immediate patching is not feasible, implement input validation and output encoding via Drupal's sanitization APIs (filter_xss() for user-controlled content and check_plain() for tag display), enable a restrictive Content Security Policy (CSP) header to prevent inline script execution, and restrict Tagify module permissions to trusted user roles only. Monitor for suspicious tag submissions and consider disabling the Tagify module temporarily if no patch can be applied within 48 hours.