David Galeano

Stored Cross-site Scripting (XSS) occurs because the module fails to properly sanitize the name of parent taxonomy terms when rendering suggestions in the Tagify dropdown. This allows an attacker with permissions to create or edit taxonomy terms in a vocabulary to execute arbitrary JavaScript within the context of a user session.

The Tagify module for Drupal does not properly sanitize user-provided input before using it in JavaScript templates within the Tagify widget. This allows for the execution of arbitrary JavaScript code in a user's browser when content is created or edited. The issue stems from insufficient input neutralization during web page generation, leading to a Cross-Site Scripting (XSS) condition.

A flaw exists in Drupal Tagify that allows for Cross-Site Scripting (XSS). This issue is due to improper neutralization of input during web page generation. The vulnerability could potentially allow attackers to inject malicious scripts into web pages viewed by other users.