Drupal Tagify Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in the Drupal Tagify module, affecting versions prior to 1.2.44. The issue arises from improper sanitization of the 'infoLabel' value in certain configurations, allowing for the injection of malicious scripts. This vulnerability requires user-level access to exploit and is only present in uncommon module configurations that expose the affected 'infoLabel' output.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users of the Tagify module for Drupal should upgrade to version 1.2.44.