Drupal EUVD-2026-15469

While CVSS and EPSS scores are not provided in the intelligence data, XSS vulnerabilities in widely-used content management modules like Drupal Tagify typically carry high exploitability risk due to their broad attack surface and ease of weaponization. The vulnerability affects a core user input mechanism (tag creation), which is likely to be accessible to authenticated or unauthenticated users depending on module configuration, suggesting an Attack Vector of Network and likely Low Attack Complexity. The absence of CVSS vector details prevents precise quantification, but CWE-79 XSS flaws are historically among the most exploited vulnerability classes. KEV (Known Exploited Vulnerability) status is unknown from the provided data, but the public disclosure via Drupal security advisory (EUVD-2026-15469) and the broad version range affected (0.0.0 to 1.2.48) indicate this should be treated as a production-priority remediation. The availability of a clear patch boundary (version 1.2.49) suggests a straightforward mitigation path.

An attacker creates a malicious tag containing JavaScript payload (e.g., '<img src=x onerror="fetch('/steal?cookie='+document.cookie)">') and submits it through a Drupal form using Tagify. When other authenticated users view the page containing this tag, the script executes in their browser context without requiring additional user interaction, exfiltrating session cookies or performing actions on their behalf. The attack is particularly effective if Tagify is used on high-traffic pages or in comment sections where many users may encounter the malicious payload.