Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-53987 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup via PluginTagTag::preKanbanContent() without output escaping, resulting in stored cross-site scripting. An authenticated user with TAG MANAGEMENT create or update rights can set a tag name containing HTML, which then executes in the browser of any user who opens the Kanban view of a ticket, problem, change, or project the tag is attached to.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:5.4 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CNA: [email protected]CVSS-B:6.4 MEDIUMVector:CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/pluginsGLPI/tag	[email protected]	Source CodeVendor
https://github.com/pluginsGLPI/tag/commit/49e6b6eb5f83bcd84139a5e5ec54c0ddd14acc90	[email protected]	Source CodeVendor
https://github.com/pluginsGLPI/tag/releases/tag/2.14.4	[email protected]	Release NotesVendor
https://github.com/pluginsGLPI/tag/security/advisories/GHSA-6rpj-89c7-x2mh	[email protected]	AdvisoryBroken LinkVendor
https://www.vulncheck.com/advisories/glpi-tag-plugin-stored-cross-site-scripting-in-kanban-badge-rendering	[email protected]

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	[email protected]

Affected Products

Product	Versions
pluginsGLPI Tag	< 2.14.4 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 2.14.4moderate efforthttps://github.com/pluginsGLPI/tag/releases/download/2.14.4/glpi-tag-2.14.4.tar.bz2

Change History

4 change records found show changes

Date	Action	Recorded By
Jul 20, 2026	CVE Modified	[email protected]
Jul 10, 2026	CVE Modified	[email protected]
Jul 9, 2026	CVE Modified	CISA-ADP
Jul 9, 2026	New CVE Received	[email protected]