Moodle: Reflected XSS via question bank filter (CVE-2025-26530)
A reflected cross-site scripting (XSS) vulnerability exists in the question bank filter of Moodle. This issue arises because the filter did not sufficiently sanitize input, allowing malicious scripts to be reflected back to users. The vulnerability affects specific Moodle versions prior to patched releases. A fix has been made available to address this sanitization deficiency.
AI Analysis
Technical Summary
CVE-2025-26530 describes a reflected XSS vulnerability in Moodle's question bank filter. The filter lacked adequate input sanitization, which could allow an attacker to inject and reflect malicious scripts in responses. This vulnerability affects Moodle versions 4.3.0 through 4.3.9, 4.4.0 through 4.4.5, and 4.5.0 through 4.5.1. The issue has been resolved in later versions, with patches available as referenced in the Moodle git repository under commit MDL-84146.
Potential Impact
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser when interacting with the question bank filter. This may lead to session hijacking, information disclosure, or other typical reflected XSS impacts. No known exploits in the wild have been reported.
Mitigation Recommendations
A patch is available and should be applied to affected Moodle installations. The fix is included in versions 4.3.10 and later, 4.4.6 and later, and 4.5.2 and later. Administrators should update to these versions to remediate the vulnerability.
Moodle: Reflected XSS via question bank filter (CVE-2025-26530)
Description
A reflected cross-site scripting (XSS) vulnerability exists in the question bank filter of Moodle. This issue arises because the filter did not sufficiently sanitize input, allowing malicious scripts to be reflected back to users. The vulnerability affects specific Moodle versions prior to patched releases. A fix has been made available to address this sanitization deficiency.
Affected software
pkg:bitnami/moodleRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-26530 describes a reflected XSS vulnerability in Moodle's question bank filter. The filter lacked adequate input sanitization, which could allow an attacker to inject and reflect malicious scripts in responses. This vulnerability affects Moodle versions 4.3.0 through 4.3.9, 4.4.0 through 4.4.5, and 4.5.0 through 4.5.1. The issue has been resolved in later versions, with patches available as referenced in the Moodle git repository under commit MDL-84146.
Potential Impact
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser when interacting with the question bank filter. This may lead to session hijacking, information disclosure, or other typical reflected XSS impacts. No known exploits in the wild have been reported.
Mitigation Recommendations
A patch is available and should be applied to affected Moodle installations. The fix is included in versions 4.3.10 and later, 4.4.6 and later, and 4.5.2 and later. Administrators should update to these versions to remediate the vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-moodle-2025-26530
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2025-26530"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Medium
Patch Information
Threat ID: 6aa00610acd9273b49ab7388
Added to database: 09/08/2026, 12:56:48 UTC
Last enriched: 09/08/2026, 13:41:32 UTC
Last updated: 09/10/2026, 19:36:49 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.