Sign in
Deutsch English Español Polski
Medium

Moodle Persistent Cross-site Scripting (XSS)

  • Disclosed: 24.05.2022
  • Updated: 11.10.2026 10:22

Persistent XSS in /course/modedit.php of Moodle through 3.7.2 allows authenticated users (Teacher and above) to inject JavaScript into the session of another user (e.g., enrolled student or site administrator) via the introeditor[text] parameter. NOTE: the discoverer and vendor disagree on whether Moodle customers have a reasonable expectation that anyone authenticated as a Teacher can be trusted with the ability to add arbitrary JavaScript (this ability is not documented on Moodle's Teacher_role page). Because the vendor has this expectation, they have stated "this report has been closed as a false positive, and not a bug."

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package moodle/moodle >= 3.7, <= 3.7.2 no fix

References

CVSS score 5.4/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE)
CWE-79
Platform
Composer
Package
moodle/moodle
Disclosed
24.05.2022
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-q6vw-27c6-jv9c - CC BY 4.0

Vulnerability history: moodle/moodle

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (437) in the archive
Total entries
437
First → latest
03.2021 02.2026
Without a fix
10
Exploited in attacks
0

Severity breakdown

  • Critical 16
  • High 68
  • Medium 318
  • Low 35

Disclosures per year

Severity:
  1. Moodle Persistent Cross-site Scripting (XSS) this entry
    Medium · 5.4 CVE-2019-18210 >= 3.7, <= 3.7.2 no fix
  2. Moodle has a Remote Code Execution risk via file restore
    High · 7.2 CVE-2026-26045 >= 5.1.0-beta, < 5.1.2, >= 5.0.0-beta, < 5.0.5, < 4.5.9 5.1.2, 5.0.5, 4.5.9
  3. Moodle Affected by Improper Restriction of Excessive Authentication Attempts
    High · 7.5 CVE-2025-67853 < 4.1.22, >= 4.4.0-beta, < 4.4.12, >= 4.5.0-beta, < 4.5.8, >= 5.0.0-beta, < 5.0.4, >= 5.1.0-beta, < 5.1.1 4.1.22, 4.4.12, 4.5.8, 5.0.4, 5.1.1
  4. Moodle authentication bypass vulnerability
    High · 8.1 CVE-2025-67848 < 4.1.22, >= 4.4.0-beta, < 4.4.12, >= 4.5.0-beta, < 4.5.8, >= 5.0.0-beta, < 5.0.4, >= 5.1.0-beta, < 5.1.1 4.1.22, 4.4.12, 4.5.8, 5.0.4, 5.1.1
  5. Moodle Cross-site Scripting (XSS) vulnerability
    High · 7.3 CVE-2025-67849 < 4.1.22, >= 4.4.0-beta, < 4.4.12, >= 4.5.0-beta, < 4.5.8, >= 5.0.0-beta, < 5.0.4, >= 5.1.0-beta, < 5.1.1 4.1.22, 4.4.12, 4.5.8, 5.0.4, 5.1.1
  6. Moodle vulnerable to Cross-site Scripting
    High · 7.3 CVE-2025-67850 < 4.1.22, >= 4.4.0-beta, < 4.4.12, >= 4.5.0-beta, < 4.5.8, >= 5.0.0-beta, < 5.0.4, >= 5.1.0-beta, < 5.1.1 4.1.22, 4.4.12, 4.5.8, 5.0.4, 5.1.1
  7. Moodle affected by a code injection vulnerability
    High · 8.8 CVE-2025-67847 >= 5.1.0-beta, < 5.1.1, >= 5.0.0-beta, < 5.0.4, >= 4.5.0-beta, < 4.5.8, >= 4.2.0-beta, < 4.4.12, < 4.1.22 5.1.1, 5.0.4, 4.5.8, 4.4.12, 4.1.22
  8. Moodle vulnerable to brute-force password guesses
    High · 7.5 CVE-2025-62399 >= 5.0.0-beta, < 5.0.3, >= 4.5.0-beta, < 4.5.7, >= 4.2.0-beta, < 4.4.11, < 4.1.21 5.0.3, 4.5.7, 4.4.11, 4.1.21
  9. Moodle has an authenticated remote code execution risk in the Moodle LMS EQUELLA repository
    High · 8.8 CVE-2025-3642 < 4.1.18, >= 4.3.0-beta, < 4.3.12, >= 4.4.0-beta, < 4.4.8, >= 4.5.0-beta, < 4.5.4 4.1.18, 4.3.12, 4.4.8, 4.5.4
  10. Moodle has an authenticated remote code execution risk in the Moodle LMS Dropbox repository
    High · 8.8 CVE-2025-3641 < 4.1.18, >= 4.3.0-beta, < 4.3.12, >= 4.4.0-beta, < 4.4.8, >= 4.5.0-beta, < 4.5.4 4.1.18, 4.3.12, 4.4.8, 4.5.4
  11. Moodle allows unauthenticated REST API user data exposure
    High · 7.5 CVE-2025-32044 >= 4.5.0-beta, < 4.5.3 4.5.3
  12. Moodle allows reflected XSS via question bank filter
    High · 8.3 CVE-2025-26530 >= 4.5.0-beta, < 4.5.2, >= 4.4.0-beta, < 4.4.6, >= 4.3.0-beta, < 4.3.10 4.5.2, 4.4.6, 4.3.10
  13. Moodle has a stored XSS risk in admin live log
    High · 8.3 CVE-2025-26529 >= 4.5.0-beta, < 4.5.2, >= 4.4.0-beta, < 4.4.6, >= 4.3.0-beta, < 4.3.10, < 4.1.16 4.5.2, 4.4.6, 4.3.10, 4.1.16
  14. Moodle has an arbitrary file read risk through pdfTeX
    High · 8.6 CVE-2025-26525 >= 4.5.0-beta, < 4.5.2, >= 4.4.0-beta, < 4.4.6, >= 4.3.0-beta, < 4.3.10, < 4.1.16 4.5.2, 4.4.6, 4.3.10, 4.1.16
  15. Moodle has a SQL injection risk in course search module list filter
    High · 8.1 CVE-2025-26533 >= 4.5.0-beta, < 4.5.2, >= 4.4.0-beta, < 4.4.6, >= 4.3.0-beta, < 4.3.10, < 4.1.16 4.5.2, 4.4.6, 4.3.10, 4.1.16
  16. Moodle Remote Code Execution vulnerability
    High · 8.1 CVE-2024-43425 < 4.1.12, >= 4.2.0-beta, < 4.2.9, >= 4.3.0-beta, < 4.3.6, >= 4.4.0-beta, < 4.4.2 4.1.12, 4.2.9, 4.3.6, 4.4.2
  17. Moodle has CSRF risk in Feedback non-respondents report
    High · 8.1 CVE-2024-43434 < 4.1.12, >= 4.2.0-beta, < 4.2.9, >= 4.3.0-beta, < 4.3.6, >= 4.4.0-beta, < 4.4.2 4.1.12, 4.2.9, 4.3.6, 4.4.2
  18. Moodle ReCAPTCHA can be bypassed on the login page
    High · 7.5 CVE-2024-34009 >= 4.3.0, < 4.3.4 4.3.4
  19. Moodle CSRF risk in analytics management of models
    High · 8.8 CVE-2024-34008 >= 4.3.0, < 4.3.4, >= 4.2.0, < 4.2.7, < 4.1.10 4.3.4, 4.2.7, 4.1.10
  20. Moodle Authenticated LFI risk in some misconfigured shared hosting environments
    High · 6.5 CVE-2024-34005 >= 4.3.0, < 4.3.4, >= 4.2.0, < 4.2.7, < 4.1.10 4.3.4, 4.2.7, 4.1.10
  21. Moodle Authenticated LFI risk in some misconfigured shared hosting environments
    High · 6.5 CVE-2024-34002 >= 4.3.0, < 4.3.4, >= 4.2.0, < 4.2.7, < 4.1.10 4.3.4, 4.2.7, 4.1.10
  22. Moodle CSRF risk in admin preset tool management of presets
    High · 8.4 CVE-2024-34001 >= 4.3.0, < 4.3.4, >= 4.2.0, < 4.2.7, < 4.1.10 4.3.4, 4.2.7, 4.1.10
  23. Moodle Improper Input Validation
    High CVE-2024-33999 >= 4.3.0, < 4.3.4 4.3.4
  24. Uncontrolled Resource Consumption in moodle
    High · 7.5 CVE-2024-25978 >= 4.3.0, < 4.3.3, >= 4.2.0, < 4.2.6, < 4.1.9 4.3.3, 4.2.6, 4.1.9
  25. Cross-Site Request Forgery in moodle
    High · 8.8 CVE-2024-25982 >= 4.3.0, < 4.3.3, >= 4.2.0, < 4.2.6, < 4.1.9 4.3.3, 4.2.6, 4.1.9
  26. Moodle Code Injection vulnerability
    High · 8.8 CVE-2023-5540 < 4.3.0-rc2 4.3.0-rc2
  27. Moodle vulnerable to Server Side Request Forgery
    High · 7.5 CVE-2023-35133 >= 4.2.0, < 4.2.1, >= 4.1.0, < 4.1.4, >= 4.0.0, < 4.0.9, >= 3.10.0, < 3.11.15, < 3.9.22 4.2.1, 4.1.4, 4.0.9, 3.11.15, 3.9.22
  28. Moodle SQL Injection vulnerability
    High · 7.3 CVE-2023-30944 < 4.2.0-rc2 4.2.0-rc2
  29. Moodle's Mustache pix helper contained a potential Mustache injection risk if combined with user input
    Critical · 9.8 CVE-2023-28333 >= 4.1.0, < 4.1.2, >= 4.0.0, < 4.0.7, >= 3.11.0, < 3.11.13, < 3.9.20 4.1.2, 4.0.7, 3.11.13, 3.9.20
  30. Moodle SQL Injection vulnerability
    High · 8.8 CVE-2023-28329 >= 4.1.0, < 4.1.2, >= 4.0.0, < 4.0.7, >= 3.11.0, < 3.11.13, < 3.9.20 4.1.2, 4.0.7, 3.11.13, 3.9.20
  31. Moodle vulnerable to Cross-site Request Forgery
    High · 8.8 CVE-2023-28335 >= 4.1.0, < 4.1.2 4.1.2
  32. Moodle vulnerable to Uncontrolled Resource Consumption
    High · 7.5 CVE-2021-36395 >= 3.11.0-beta, < 3.11.1, >= 3.10.0-beta, < 3.10.5, < 3.9.8 3.11.1, 3.10.5, 3.9.8
  33. Moodle Session Fixation vulnerability
    Critical · 9.8 CVE-2021-36394 >= 3.11.0-beta, < 3.11.1, >= 3.10.0-beta, < 3.10.5, < 3.9.8 3.11.1, 3.10.5, 3.9.8
  34. Moodle vulnerable to Server-Side Request Forgery
    High · 7.5 CVE-2021-36396 >= 3.11.0-beta, < 3.11.1, >= 3.10.0-beta, < 3.10.5, < 3.9.8 3.11.1, 3.10.5, 3.9.8
  35. Moodle SQL Injection vulnerability
    Critical · 9.8 CVE-2021-36393 >= 3.11.0-beta, < 3.11.1, >= 3.10.0-beta, < 3.10.5, < 3.9.8 3.11.1, 3.10.5, 3.9.8
  36. Moodle SQL Injection vulnerability
    Critical · 9.8 CVE-2021-36392 >= 3.11.0-beta, < 3.11.1, >= 3.10.0-beta, < 3.10.5, < 3.9.8 3.11.1, 3.10.5, 3.9.8
  37. Moodle Improper Access Control vulnerability
    High · 8.2 CVE-2023-23923 < 3.9.19, >= 3.10.0, < 3.11.12, >= 4.0.0-beta, < 4.0.6, >= 4.1.0-beta, < 4.1.1 3.9.19, 3.11.12, 4.0.6, 4.1.1
  38. Moodle blind Server-Side Request Forgery (SSRF) vulnerability in LTI provider library
    Critical · 9.1 CVE-2022-45152 >= 3.9, < 3.9.18, >= 3.11, < 3.11.11, >= 4.0, < 4.0.5 3.9.18, 3.11.11, 4.0.5
  39. Moodle Cross-Site Request Forgery (CSRF)
    High · 8.8 CVE-2022-2986 >= 3.11, < 3.11.9, >= 4.0, < 4.0.3 3.11.9, 4.0.3
  40. Moodle Minor SQL injection risk in admin user browsing
    Critical · 9.8 CVE-2022-40315 >= 3.9, < 3.9.17, >= 3.11, < 3.11.10, >= 4.0, < 4.0.4 3.9.17, 3.11.10, 4.0.4
  41. Moodle remote code execution
    Critical · 9.8 CVE-2022-40314 < 3.9.17, >= 3.11, < 3.11.10, >= 4.0, < 4.0.4 3.9.17, 3.11.10, 4.0.4
Show more (20) Showing 41 of 85

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.