What’s Vulnerable › Vulnerabilities

CVE-2026-53987: Tag Plugin for GLPI 11 before 2.14.4 Stored Cross-Site Scripting in Kanban Badge Rendering

• Severity: medium (CVSS 6.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-09 · updated 2026-10-29
• Weakness: CWE-79

Description

The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup via PluginTagTag::preKanbanContent() without output escaping, resulting in stored cross-site scripting. An authenticated user with TAG MANAGEMENT create or update rights can set a tag name containing HTML, which then executes in the browser of any user who opens the Kanban view of a ticket, problem, change, or project the tag is attached to.

Affected products

• pluginsGLPI tag: from 2.6.0 before 2.14.4 — fixed in 2.14.4

How to fix

Upgrade to a fixed version: pluginsGLPI tag 2.14.4. Check the vendor advisory for mitigations.

References

• https://github.com/pluginsGLPI/tag
• https://github.com/pluginsGLPI/tag/commit/49e6b6eb5f83bcd84139a5e5ec54c0ddd14acc90
• https://github.com/pluginsGLPI/tag/releases/tag/2.14.4
• https://github.com/pluginsGLPI/tag/security/advisories/GHSA-6rpj-89c7-x2mh
• https://www.vulncheck.com/advisories/glpi-tag-plugin-stored-cross-site-scripting-in-kanban-badge-rendering

Get alerted when CVE-2026-53987 or the next vulnerability affects your stack