CVE-2024-38274 is a stored XSS vulnerability in Moodle caused by improper escaping of calendar event titles when deleting events. This flaw allows malicious scripts embedded in event titles to execute in users' browsers during the deletion confirmation, potentially leading to session hijacking or other script-based attacks. The vulnerability affects Moodle versions 4.1.0 through before 4.1.11, 4.2.0 through before 4.2.8, 4.3.0 through before 4.3.5, and 4.4.0 before 4.4.1. A patch is available to address this issue.

The vulnerability enables stored XSS attacks via calendar event titles in Moodle, which could allow attackers to execute arbitrary scripts in the context of authenticated users interacting with the event deletion prompt. This may lead to unauthorized actions such as session hijacking or data theft within the affected Moodle instance. There are no known exploits in the wild at this time.

A patch is available for this vulnerability. Users should upgrade to Moodle versions 4.1.11 or later, 4.2.8 or later, 4.3.5 or later, or 4.4.1 or later to remediate the issue. Applying the official fixes will prevent exploitation of the stored XSS vulnerability in calendar event titles.