Vulnerability · Published Feb 3, 2026 · Assigned by fedora
CVE-2025-67849Moodle: moodle: cross-site scripting (xss) via improper sanitization of ai prompt responses
High 7.3
In plain English
A high-severity cross-site scripting in moodle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.3%top 81.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw was found in Moodle. This cross-site scripting (XSS) vulnerability, caused by improper sanitization of AI prompt responses, allows attackers to inject malicious HTML or script into web pages. When other users view these compromised pages, their sessions could be stolen, or the user interface could be manipulated.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | moodle/moodle | 4.1.22 | GHSA-mhf6-pp52-8wqj |
| Packagist | moodle/moodle | 4.4.12 | GHSA-mhf6-pp52-8wqj |
| Packagist | moodle/moodle | 4.5.8 | GHSA-mhf6-pp52-8wqj |
| Packagist | moodle/moodle | 5.0.4 | GHSA-mhf6-pp52-8wqj |
| Packagist | moodle/moodle | 5.1.1 | GHSA-mhf6-pp52-8wqj |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| moodle | 4.5.0 – before 4.5.85.0.0 – before 5.0.45.1.0 – before 5.1.1 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
References
- https://access.redhat.com/security/cve/CVE-2025-67849 vdb-entry, x_refsource_REDHAT
- RHBZ#2423835 issue-tracking, x_refsource_REDHAT