CVE-2025-26528: Moodle Drag-and-Drop Question Type Stored XSS Vulnerability
Summary
CVE-2025-26528: Moodle has a stored XSS in ddimageortext question type. Affects moodle/moodle across 4 version ranges.
< 4.1.16
>= 4.3.0-beta, < 4.3.10
>= 4.4.0-beta, < 4.4.6
>= 4.5.0-beta, < 4.5.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2025-26528 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is a widely-used open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. The platform supports various question types, including the drag-and-drop onto image (ddimageortext) question type, which allows users to create interactive assessments. However, this functionality has been found to have a stored XSS vulnerability, which could be exploited if not properly addressed.
Vulnerability Detail
The vulnerability arises from insufficient sanitization of user inputs in the ddimageortext question type, leading to a stored Cross-Site Scripting (XSS) risk. An attacker could exploit this vulnerability by injecting malicious scripts into the question type, which would then be executed in the context of other users accessing the affected content. This could result in unauthorized actions being performed on behalf of the user, data theft, or other malicious activities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.164.1.16composer require moodle/moodle:4.1.16 -
>= 4.3.0-beta, < 4.3.104.3.10composer require moodle/moodle:4.3.10 -
>= 4.4.0-beta, < 4.4.64.4.6composer require moodle/moodle:4.4.6 -
>= 4.5.0-beta, < 4.5.24.5.2composer require moodle/moodle:4.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can limit access to the ddimageortext question type until the update is applied. This can be done by modifying user permissions in the Moodle settings to restrict the ability to create or edit such questions.
Conclusion
The stored XSS vulnerability in Moodle's ddimageortext question type poses a risk to users and their data. It is crucial for administrators to update their Moodle installations to the latest patched versions to mitigate this risk. Additionally, using tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for moodle/moodle →
FAQ
The vulnerability is a stored XSS issue in the drag-and-drop onto image question type, which allows attackers to inject malicious scripts.
Any Moodle installation using the affected versions of the ddimageortext question type is at risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could lead to unauthorized actions, data theft, or other malicious activities affecting users.
Yes, the CVSS score for this vulnerability is 3.4, indicating a low severity level.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
