| Summary | An authenticated attacker can store a crafted tag value in _user_tags and trigger JavaScript execution when a victim opens the list/report view where tags are rendered. The vulnerable renderer interpolates tag content into HTML attributes and element content without escaping. |
|---|---|
| Publication Date | April 23, 2026, 5:16 a.m. |
| Registration Date | April 25, 2026, 4:06 a.m. |
| Last Update | April 23, 2026, 6:23 a.m. |