{"id":"CVE-2026-53987","title":"Tag Plugin for GLPI 11 before 2.14.4 Stored Cross-Site Scripting in Kanban Badge Rendering","summary":"The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup via PluginTagTag::preKanbanContent() without output escaping, resulting in stored cross-site scripting. An…","severity":"medium","cvss":6.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-79"],"vendor":"pluginsGLPI","product":"tag","affected":["tag >= 2.6.0 < 2.14.4"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-07-09T17:48:51.132634Z"},"published":"2026-07-09","updated":"2026-11-08","sourceUpdated":"2026-11-08T14:05:17.060Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-53987","references":[{"url":"https://github.com/pluginsGLPI/tag/security/advisories/GHSA-6rpj-89c7-x2mh","label":"GitHub Security Advisory (GHSA-6rpj-89c7-x2mh)"},{"url":"https://github.com/pluginsGLPI/tag/releases/tag/2.14.4","label":"Tag Plugin 2.14.4 Release Notes"},{"url":"https://github.com/pluginsGLPI/tag","label":"Product"},{"url":"https://github.com/pluginsGLPI/tag/commit/49e6b6eb5f83bcd84139a5e5ec54c0ddd14acc90","label":"Patch Commit"},{"url":"https://www.vulncheck.com/advisories/glpi-tag-plugin-stored-cross-site-scripting-in-kanban-badge-rendering"}],"tags":["cve.org"],"epss":0.00503,"epssPercentile":0.4329,"ingestedAt":"2026-11-03T08:39:35.552Z","slug":"CVE-2026-53987","body":"## Overview\n\nThe Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup via PluginTagTag::preKanbanContent() without output escaping, resulting in stored cross-site scripting. An authenticated user with TAG MANAGEMENT create or update rights can set a tag name containing HTML, which then executes in the browser of any user who opens the Kanban view of a ticket, problem, change, or project the tag is attached to.\n\n## Affected\n\n- `tag >= 2.6.0 < 2.14.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":35.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}