This vulnerability is a reflected XSS issue (CWE-79) in the Moodle Jmol plugin (version 6.1 and prior). The plugin fails to properly neutralize user input passed through the 'data' parameter in the jsmol.php script before including it in the HTTP response. An attacker can exploit this by crafting a malicious URL that, when visited by a victim, executes arbitrary JavaScript in the victim's browser context. This can be used to hijack user sessions or alter page content. The vulnerability was confirmed with exploitation evidence observed by the Shadowserver Foundation on 2025-02-02 UTC. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, user interaction required, and low scope impact.

Successful exploitation allows execution of arbitrary JavaScript in the context of the victim's browser, potentially enabling session hijacking or manipulation of the displayed web page content. This can compromise user data confidentiality and integrity within the Moodle LMS environment. However, the impact is limited by the need for user interaction (clicking a malicious link) and the reflected nature of the XSS.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links involving the Jmol plugin and consider disabling or restricting the plugin if feasible. Monitor Moodle vendor communications for updates on patches or official mitigations.