CVE-2026-11908

The vulnerability in Drupal Tagify allows for stored cross-site scripting (XSS) due to improper input neutralization during web page generation, affecting versions from 0.0.0 to 1.2.52. This could enable attackers to inject malicious scripts that execute in the context of users' browsers, potentially compromising user data and session integrity. Organizations using these affected versions should prioritize patching to mitigate the risk of exploitation.