GHSA-h697-w4ph-7pcxLowCVSS 3.4

Moodle has a stored XSS in ddimageortext question type

Published
February 24, 2025
Last Modified
February 24, 2025

🔗 CVE IDs covered (1)

CVE-2025-26528 →

📋 Description

The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk.

🎯 Affected products4

  • composer/moodle/moodle:>= 4.5.0-beta, < 4.5.2
  • composer/moodle/moodle:>= 4.4.0-beta, < 4.4.6
  • composer/moodle/moodle:>= 4.3.0-beta, < 4.3.10
  • composer/moodle/moodle:< 4.1.16

🔗 References (4)