Drupal Tagify contains a cross‑site scripting flaw that occurs when user supplied content is rendered without proper escaping. The vulnerability allows an attacker to inject malicious JavaScript that runs in the browser of any visitor who views the affected content and can result in session hijacking, credential theft, defacement or delivery of additional payloads. This is a classic example of CWE‑79.

The issue affects the Tagify module for Drupal from the initial version 0.0.0 up to and including 1.2.48. All installations of Tagify before version 1.2.49 are vulnerable, so administrators should verify the module version on every site and determine whether a dangerous release is present.

The CVSS score of 5.4 indicates a moderate severity, while an EPSS score of less than 1 % suggests that attacks are currently considered unlikely. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Exploitation requires an attacker to deliver crafted input that is rendered in the browser, thus the threat is client‑side and depends on users visiting the compromised content. Prevention hinges on upgrading the module or applying input filtering to eliminate the unsafe rendering.