Is CVE-2026-53987 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53987 being exploited in the wild.

How severe is CVE-2026-53987?

Medium severity, with a CVSS score of 6.4, published 9 July 2026.

Which products and versions are affected?

GLPI Project Tag >= 2.6.0, < 2.14.4.

Is there a fix for CVE-2026-53987?

A patch was published on 2026-06-24: Version 2.14.4 released to address the vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-53987 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-53987?

Check whether you run GLPI Project Tag at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53987: pluginsGLPI Tag plugin for GLPI stored XSS in Kanban view

Q: Is there a fix for CVE-2026-53987?

A patch was published on 2026-06-24: Version 2.14.4 released to address the vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-53987 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-53987?

Check whether you run GLPI Project Tag at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53987 · Severity: medium · CVSS 6.4 · Published 2026-07-09

The Tag plugin for GLPI, a tool used for organizing assets and tickets, contains a security flaw that allows malicious code to be stored within tag names. An attacker with permission to manage tags can inject scripts that will automatically run in the browsers of other staff members when they view project boards or ticket summaries. This could lead to unauthorized actions being performed on behalf of legitimate users or the theft of sensitive session information.

Vendors: GLPI Project.

Quick answers

Is CVE-2026-53987 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53987 being exploited in the wild.
How severe is CVE-2026-53987?: Medium severity, with a CVSS score of 6.4, published 9 July 2026.
Which products and versions are affected?: GLPI Project Tag >= 2.6.0, < 2.14.4.
Is there a fix for CVE-2026-53987?: A patch was published on 2026-06-24: Version 2.14.4 released to address the vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53987 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-53987?: Check whether you run GLPI Project Tag at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in the Tag plugin for GLPI 11 (versions 2.6.0 through 2.14.3). The root cause is the lack of HTML sanitization and output escaping in the `PluginTagTag::preKanbanContent()` function when rendering tag names into Kanban badge markup. An authenticated attacker with 'TAG MANAGEMENT' create or update privileges can inject malicious HTML/JavaScript into a tag name. This payload executes in the context of any user who views the Kanban board for a ticket, problem, change, or project associated with that tag. The issue is resolved in version 2.14.4.

Affected products

pluginsGLPI Tag plugin for GLPI 11 >= 2.6.0, < 2.14.4

Timeline

2026-06-24: patched: Version 2.14.4 released to address the vulnerability.
2026-07-09: disclosed: CVE-2026-53987 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.