View online: https://www.drupal.org/sa-contrib-2025-121 Project: Tagify [1] Date: 2025-December-03 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross-site Scripting Affected versions: <1.2.44 CVE IDs: CVE-2025-13983 Description:  This module enables you to use the Tagify library to enhance text input fields with tag-style UI elements. The module does not sufficiently sanitize the infoLabel value under certain configurations, which can result in a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that only uncommon module configurations expose the affected infoLabel output, and an attacker must have user-level access to supply or manipulate this value. Solution:  Install the latest version: * If you use the Tagify module for Drupal, upgrade to Tagify 1.2.44 [3]. Reported By:  * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By:  * Bram Driesen (bramdriesen) [5] provisional member of the Drupal Security Team * David Galeano (gxleano) [6] * Lee Rowlands (larowlan) [7] of the Drupal Security Team * Drew Webber (mcdruid) [8] of the Drupal Security Team Coordinated By:  * Bram Driesen (bramdriesen) [9] provisional member of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Drew Webber (mcdruid) [11] of the Drupal Security Team * Jess (xjm) [12] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/tagify [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tagify/releases/1.2.44 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/bramdriesen [6] https://www.drupal.org/u/gxleano [7] https://www.drupal.org/u/larowlan [8] https://www.drupal.org/u/mcdruid [9] https://www.drupal.org/u/bramdriesen [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/mcdruid [12] https://www.drupal.org/u/xjm [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....