Every CVE Search/ Get API key

CVE-2025-26530

Reflected XSS via question bank filter

8.3 HighFix available

The question bank filter required additional sanitizing to prevent a reflected XSS risk.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.36%Up 0.3 points since Feb 27, 2025
90%50%10%1%

What each source reports

CVE List Score used 8.3

Reflected XSS via question bank filter

The question bank filter required additional sanitizing to prevent a reflected XSS risk.

Record
CVE-2025-26530
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2025-4271 8.3

The question bank filter required additional sanitizing to prevent a reflected XSS risk.

Record
EUVD-2025-4271
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-4w32-c9g7-27qx 8.3

Moodle allows reflected XSS via question bank filter

The question bank filter required additional sanitizing to prevent a reflected XSS risk.

Record
GHSA-4w32-c9g7-27qx
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-79
Updated
2026-11-02
NVD 8.3

The question bank filter required additional sanitizing to prevent a reflected XSS risk.

Record
CVE-2025-26530
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 8.3

Reflected XSS via question bank filter

The question bank filter required additional sanitizing to prevent a reflected XSS risk.

Record
CVE-2025-26530
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-4w32-c9g7-27qx 8.3

Moodle allows reflected XSS via question bank filter

The question bank filter required additional sanitizing to prevent a reflected XSS risk.

Record
GHSA-4w32-c9g7-27qx
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-79
Updated
2026-11-02
OSVUBUNTU-CVE-2025-26530 8.3

The question bank filter required additional sanitizing to prevent a reflected XSS risk.

Record
UBUNTU-CVE-2025-26530
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVBIT-moodle-2025-26530 No score

Reflected XSS via question bank filter

The question bank filter required additional sanitizing to prevent a reflected XSS risk.

Record
BIT-moodle-2025-26530
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
moodle/moodle
Packagist
 4.5.0-beta up to 4.5.2
4.5.2
moodle/moodle
Packagist
 4.4.0-beta up to 4.4.6
4.4.6
moodle/moodle
Packagist
 4.3.0-beta up to 4.3.10
4.3.10
moodle
Bitnami
 4.3.0 up to 4.3.10, 4.4.0 up to 4.4.6, 4.5.0 up to 4.5.2
4.3.104.4.64.5.2
moodle/moodle
Packagist
 4.5.0-beta up to 4.5.2, plus listed versions
v4.5.0v4.5.0-betav4.5.0-rc1v4.5.0-rc2v4.5.1
4.5.2
moodle/moodle
Packagist
 4.4.0-beta up to 4.4.6, plus listed versions
v4.4.0v4.4.0-betav4.4.0-rc1v4.4.0-rc2v4.4.1
Show 4 moreShow less
v4.4.2v4.4.3v4.4.4v4.4.5
4.4.6
moodle/moodle
Packagist
 4.3.0-beta up to 4.3.10, plus listed versions
v4.3.0v4.3.0-betav4.3.0-rc1v4.3.0-rc2v4.3.1
Show 8 moreShow less
v4.3.2v4.3.3v4.3.4v4.3.5v4.3.6v4.3.7v4.3.8v4.3.9
4.3.10
moodle
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.7.9+dfsg-12.7.10+dfsg-12.7.11+dfsg-12.7.11+dfsg-22.7.12+dfsg-13.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1
 None known
moodle
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-26530 is a high vulnerability (CVSS 8.3) in Moodle, published February 24, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. Fixed in moodle/moodle 4.5.2.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open