Drupal security updates, in plain English · Module

Tagify

21,452 sites report using it · on drupal.org · 2 security updates explained here

This module provides a dropdown menu to help users select categories when filling out forms.

Below is every security update for Tagify that this site has covered, newest first. Each one says who could exploit it, whether it applies to your site, how urgent it is, and what to tell your developer. If your site uses this module and you are not sure which version, that is the first question to ask whoever looks after it.

Tagify

Moderately critical · 21,452 sites report using it · SA-CONTRIB-2026-043 · on drupal.org · Week of 10 June 2026

A flaw in the dropdown menu allows scripts to be hidden inside the names of parent categories. Someone could run these scripts in the browser of another user to view private information or make unauthorised changes. They could not take full control of the website.

Who could do thisOnly someone with a login on your site.
Does it apply to youThis applies if the site gives users the access right to create or edit categories.
Has it been used in attacksNo sign of it.
How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.

Tell your developerUpdate Tagify to 1.2.52.

For developers: what the fix changed

The fix sanitises parent taxonomy term names by wrapping `parentName` with `Drupal.checkPlain()` when generating the dropdown HTML in `js/tagify.js`. It also updates the `highlightMatchingLetters` function to escape segments individually, preventing HTML-entity corruption.

Also in this release The release also fixes `maxItems` handling in the facets widget and removes a broken Sortable dependency.

1.2.51 to 1.2.52 5 commits, 3 files.

js/tagify.js +47 −50 fix
modules/tagify_facets/js/tagify-widget.js +3 −12
modules/tagify_facets/tagify_facets.libraries.yml +0 −1

Full diff, 1.2.51 to 1.2.52

The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.

Tagify

Moderately critical · 21,452 sites report using it · SA-CONTRIB-2026-013 · on drupal.org · Week of 25 February 2026

The module does not properly clean user input before displaying it. Someone could use this to run malicious scripts in the browser when creating or editing a piece of content. They could uncover private details and manipulate website records.

Who could do thisOnly someone with a login on your site.
Does it apply to youAny site using this module.
Has it been used in attacksNo sign of it.
How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.

Tell your developerUpdate Tagify to 1.2.49.

For developers: what the fix changed

The fix sanitises user input by wrapping variables with Drupal.checkPlain in js/tagify.js. This prevents arbitrary JavaScript execution by escaping values in functions such as highlightMatchingLetters, entityIdMarkup, and tagTemplate.

1.2.48 to 1.2.49 1 commit, 1 file.

js/tagify.js +17 −12 fix

Full diff, 1.2.48 to 1.2.49

The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.

Not sure what your site is running?

Send me your Drupal site's address.

I'll tell you what I can see from outside, what the Drupal 10 end of life on 9 December means for it, and what it would cost to have me keep it patched. There's no charge for that and no obligation. peter@peterbrady.co.uk

Tagify

Tagify

Tagify

Send me your Drupal site's address.

Get in touch

Links

Reference