Moodle contains a stored XSS vulnerability (CVE-2026-102581) caused by inadequate output escaping in the templates rendering forum posts. This enables attackers with limited privileges to inject malicious scripts that execute in other users' browsers when they view the affected forum posts. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and impacts on confidentiality and integrity but not availability.

An attacker can inject malicious content into Moodle forum posts that executes arbitrary script code in the browsers of other users who view those posts. This can lead to information disclosure and integrity issues within the affected users' sessions. There is no indication of impact on availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider restricting forum posting privileges and educating users about the risks of clicking untrusted links in forum posts.