The Drupal Tagify module suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper input neutralization during web page generation. This allows an attacker with at least low privileges and requiring user interaction to inject malicious scripts that can affect confidentiality and integrity but not availability. The vulnerability affects all versions from 0.0.0 through 1.2.52. No official fix or patch has been announced, and no known exploits have been reported.

Successful exploitation could lead to disclosure of sensitive information and modification of data within the affected web application context. The vulnerability does not impact availability. The attack requires network access, low complexity, privileges, and user interaction, with a scope change possible. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting user input or applying manual input sanitization as a temporary measure. Monitor Drupal security advisories for updates regarding a patch or official mitigation.