Reflected XSS Vulnerability in Moodle's Question Bank Filter

CVE-2025-26530

What is CVE-2025-26530?

The vulnerability in Moodle's question bank filter stems from insufficient sanitization of user input, which allows attackers to inject malicious scripts that could be executed in the context of users viewing the affected page. This reflected XSS risk poses serious security concerns, as it can be exploited to manipulate sessions, deliver phishing pages, or execute unauthorized actions on behalf of victims.

References