CVE-2025-26530: Moodle Reflected XSS Vulnerability in Question Bank Filter
Summary
CVE-2025-26530: Moodle allows reflected XSS via question bank filter. Affects moodle/moodle across 3 version ranges.
>= 4.3.0-beta, < 4.3.10
>= 4.4.0-beta, < 4.4.6
>= 4.5.0-beta, < 4.5.2
Fixed in 4.3.10, 4.4.6 or 4.5.2, depending on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2025-26530 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is a widely-used open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It features a modular architecture, allowing for extensive customization and integration of various plugins. However, it has been identified that the question bank filter lacks adequate sanitization, making it susceptible to reflected cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from insufficient sanitization within the question bank filter of Moodle, which can lead to reflected XSS attacks. An attacker could exploit this vulnerability by crafting a malicious URL that, when accessed by a victim, executes arbitrary JavaScript code in the context of the victim's browser. This could lead to unauthorized actions being performed on behalf of the user, data theft, or session hijacking. The vulnerability is classified under CWE-79, indicating that it allows for improper neutralization of input during web page generation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.3.0-beta, < 4.3.104.3.10composer require moodle/moodle:4.3.10 -
>= 4.4.0-beta, < 4.4.64.4.6composer require moodle/moodle:4.4.6 -
>= 4.5.0-beta, < 4.5.24.5.2composer require moodle/moodle:4.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can avoid clicking on untrusted links that may lead to the question bank filter. Additionally, implementing Content Security Policy (CSP) headers can help mitigate the risk of XSS attacks by restricting the sources from which scripts can be executed.
Conclusion
The reflected XSS vulnerability in Moodle's question bank filter poses significant risks to users and their data. It is crucial to update to the latest patched versions to safeguard against potential exploits. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for moodle/moodle →
FAQ
Reflected XSS is a type of attack where malicious scripts are reflected off a web server, typically via a URL, and executed in the user's browser. This can lead to unauthorized actions or data theft.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to analyze your composer.lock file.
If exploited, this vulnerability can allow attackers to execute arbitrary scripts in the context of a user's session, potentially leading to data theft, session hijacking, or unauthorized actions.
While updating is the best solution, implementing Content Security Policy (CSP) headers can help mitigate the risk of XSS attacks by controlling the sources from which scripts can be executed.
If immediate updating is not possible, ensure that users are educated about the risks and avoid clicking on suspicious links. Monitor your application for any unusual activity.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
