Stored XSS Vulnerability in Moodle Drag-and-Drop Image Question Type

CVE-2025-26528

Summary

A vulnerability exists in the drag-and-drop onto image question type (ddimageortext) in Moodle, where insufficient sanitization of input can lead to a stored XSS vulnerability. This flaw allows an attacker to inject malicious scripts that can be executed in the context of other users who access the affected content. It is crucial for administrators and educators using Moodle to apply necessary patches and updates to mitigate this risk, ensuring the integrity and security of the platform.

References