The Tag plugin for GLPI 11 prior to version 2.14.4 suffers from a stored cross-site scripting vulnerability due to improper neutralization of input during web page generation. Specifically, the tag name is stored without HTML sanitization and rendered via PluginTagTag::preKanbanContent() without output escaping. This allows an authenticated user with TAG MANAGEMENT create or update rights to inject HTML code into tag names. When other users open the Kanban view of any ticket, problem, change, or project tagged with the malicious tag, the injected code executes in their browsers, leading to a stored XSS condition.

Successful exploitation allows an authenticated user with tag management privileges to execute arbitrary HTML or script code in the browsers of other users who view the Kanban interface. This can lead to session hijacking, unauthorized actions, or other malicious activities within the context of the affected GLPI instance. The vulnerability requires authenticated access with specific privileges and user interaction to view the affected Kanban views.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict TAG MANAGEMENT create or update rights to trusted users only. Monitor vendor channels for updates or patches addressing this vulnerability.