Cross-Site Scripting Vulnerability in Drupal Tagify Plugin
CVE-2025-13983

5.4MEDIUM

Key Information:

Vendor

Drupal
Status
Tagify
Vendor
CVE Published:
28 January 2026

What is CVE-2025-13983?

The Tagify plugin for Drupal has a vulnerability that allows for Cross-Site Scripting (XSS) due to improper input neutralization during web page generation, posing significant security risks. This flaw can potentially be exploited by malicious users to inject harmful scripts into web pages viewed by others, leading to data theft or user impersonation. Users are encouraged to upgrade to version 1.2.44 or later to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Tagify 0.0.0 < 1.2.44

References

https://www.drupal.org/sa-contrib-2025-121

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Drew Webber (mcdruid)
Bram Driesen (bramdriesen)
David Galeano (gxleano)
Lee Rowlands (larowlan)
Drew Webber (mcdruid)
Bram Driesen (bramdriesen)
Greg Knaddison (greggles)
Drew Webber (mcdruid)
Jess (xjm)
JSON
.