Vulnerability · Published Jun 24, 2025 · Assigned by VulnCheck

CVE-2025-34032Moodle LMS Jmol Plugin Cross-site Scripting (XSS)

Medium 5.1

In plain English

A medium-severity cross-site scripting in Jmol Plugin from Moodle. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.8%top 43.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Nuclei

Official description

A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-02 UTC.

Affected products (as reported)

Vendor	Product	Versions
Moodle	Jmol Plugin	0 – through 6.1

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

https://www.dionach.com/moodle-jmol-plugin-multiple-vulnerabilities/ exploit, technical-description
https://www.exploit-db.com/exploits/46881 third-party-advisory, exploit
https://vulncheck.com/advisories/moodle-lms-jmol-plugin-xss third-party-advisory