CVE-2025-26530: Moodle Reflected XSS Vulnerability via Question Bank Filter
Summary
CVE-2025-26530: Reflected XSS via question bank filter. Affects moodle across 3 version ranges.
>= 4.3.0, < 4.3.10
>= 4.4.0, < 4.4.6
>= 4.5.0, < 4.5.2
Fixed in 4.3.10, 4.4.6 or 4.5.2, depending on the release line you run. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2025-26530 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It is widely used in educational institutions and offers features such as course management, user management, and a variety of plugins. However, Moodle versions 4.3.0 to 4.5.2 are vulnerable to a reflected cross-site scripting (XSS) attack due to insufficient sanitization in the question bank filter.
Vulnerability Detail
The vulnerability arises from the question bank filter in Moodle, which fails to properly sanitize user inputs. This oversight allows attackers to inject malicious scripts that can be executed in the context of the user's browser. If exploited, this reflected XSS vulnerability can lead to unauthorized actions being performed on behalf of the user, data theft, or session hijacking. The affected versions include 4.3.0 to 4.5.2, with the issue fixed in versions 4.3.10, 4.4.6, and 4.5.2.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.3.0, < 4.3.104.3.10 -
>= 4.4.0, < 4.4.64.4.6 -
>= 4.5.0, < 4.5.24.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not possible, consider restricting access to the question bank filter or disabling features that utilize it until the patch can be applied. Regularly monitor user inputs and implement additional input validation where feasible.
Conclusion
The reflected XSS vulnerability in Moodle's question bank filter poses significant risks to user security. It is crucial for users to update to the patched versions to mitigate these risks effectively. Regular monitoring and input validation are recommended as additional safety measures.
See every vulnerability recorded for moodle →
FAQ
CVE-2025-26530 is a vulnerability in Moodle that allows for reflected cross-site scripting (XSS) attacks through the question bank filter.
Moodle versions 4.3.0 to 4.5.2 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized actions, data theft, or session hijacking, compromising user security.
You can restrict access to the question bank filter or disable related features until you can apply the necessary updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
