Stored Cross-Site Scripting Vulnerability in Moodle PDF Annotator Plugin by Moodle

CVE-2025-60506

What is CVE-2025-60506?

The Moodle PDF Annotator Plugin version 1.5 release 9 contains a vulnerability that allows an attacker with a low-privileged account, such as a student, to inject arbitrary JavaScript into the Public Comments feature. This malicious script is executed in the browsers of users, including students, teachers, and admins, when they access the annotated PDF. As a result, this can lead to various security risks, including session hijacking and credential theft, exposing users to the potential of unauthorized actions controlled by the attacker.

References