Project: 
Tagify
Date: 
2025-December-03
Security risk: 
Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon
Vulnerability: 
Cross-site Scripting
Affected versions: 
<1.2.44
CVE IDs: 
CVE-2025-13983
Description: 

This module enables you to use the Tagify library to enhance text input fields with tag-style UI elements.

The module does not sufficiently sanitize the infoLabel value under certain configurations, which can result in a cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that only uncommon module configurations expose the affected infoLabel output, and an attacker must have user-level access to supply or manipulate this value.

Solution: 

Install the latest version:

  • If you use the Tagify module for Drupal, upgrade to Tagify 1.2.44.
Reported By: 
Fixed By: 
Coordinated By: