{"id":"CVE-2026-3212","published":"2026-03-25T15:22:11Z","modified":"2026-03-26T14:38:54Z","title":"Tagify - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-013","vendor":"Drupal","product":"Tagify","tier":"tail","description":{"text":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issue affects Tagify: from 0.0.0 before 1.2.49.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00141,"percentile":0.03419,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-013","tags":[]}],"priority":{"score":4.5,"factors":[{"name":"EPSS percentile","points":0.68},{"name":"CVSS severity","points":3.78}]},"vendorSlug":"drupal","affectedVersions":[{"vendor":"Drupal","product":"Tagify","versions":[">= 0.0.0, < 1.2.49"]}],"affected":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/tagify","vulnerableRanges":["<1.2.49"],"patched":["1.2.49"],"from":["DRUPAL-CONTRIB-2026-013"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-15469","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-drupal-tagify-cve-2025-13983","packageHistory":[{"cve":"CVE-2025-13983","published":"2026-01-28","fixed":"1.2.44","kev":false,"link":{"from":"CVE-2025-13983","to":"CVE-2026-3212","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:https://packages.drupal.org/8:drupal/tagify","fromFixed":"1.2.44","toFixed":"1.2.49","daysApart":56},{"kind":"similar","provenance":"machine","score":1.0,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2026-3212","published":"2026-03-25","fixed":"1.2.49","kev":false},{"cve":"CVE-2026-11908","published":"2026-07-10","fixed":"1.2.52","kev":false,"link":{"from":"CVE-2026-3212","to":"CVE-2026-11908","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:https://packages.drupal.org/8:drupal/tagify","fromFixed":"1.2.49","toFixed":"1.2.52","daysApart":107},{"kind":"similar","provenance":"machine","score":0.98,"basis":"same product + CWE + description similarity"}]}}],"package":"Packagist:https://packages.drupal.org/8:drupal/tagify"}}