CVE-2026-11908

MediumCVSS 5.4/10Last modified Oct 25, 2026

Description

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Stored XSS. This issue affects Tagify versions: from 0.0.0 to 1.2.52.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 10, 2026
Last modified
Oct 25, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-119093.3Missing Authorization vulnerability in Drupal Examples for Developers allows Forceful Browsing. This issue affects Examples for Developers vCVE-2026-11914.4The JavaScript Notifier plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to, and incCVE-2026-119117.5The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the eeSFL_DelCVE-2026-119127.5The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization checks in all versiCVE-2026-119139.8vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*.CVE-2026-119145.9vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*.CVE-2026-119155.9vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*.CVE-2026-119177.2A path traversal security issue exists within Rockwell Automation ThinManager® software due to improper limitation of file save operations wCVE-2026-119185.4IBM ContextForge MCP Gateway <= v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mechanisms due to incompCVE-2026-11927.3A vulnerability was determined in Tosei Online Store Management System ネット店舗管理システム 1.01. The affected element is an unknown function of the CVE-2026-119204.9The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'oCVE-2026-119219.1IBM Verify Identity Access containers may not apply management password change operations correctly.