CVE-2025-67849

Moodle: moodle: cross-site scripting (xss) via improper sanitization of ai prompt responses

State: Published
Severity: 7.3 High
Published: Feb 3, 2026
Updated: Feb 26, 2026
Reserved: Dec 12, 2025

Description

A flaw was found in Moodle. This cross-site scripting (XSS) vulnerability, caused by improper sanitization of AI prompt responses, allows attackers to inject malicious HTML or script into web pages. When other users view these compromised pages, their sessions could be stolen, or the user interface could be manipulated.

Scores

CVSS	Score	Vector	Source
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N	fedora

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
moodle	4.5.0 to before 4.5.8Affected 5.0.0 to before 5.0.4Affected 5.1.0 to before 5.1.1Affected

References

https://access.redhat.com/security/cve/CVE-2025-67849vdb-entry
RHBZ#2423835issue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.