Reflected Cross-Site Scripting Vulnerability in VPL for Moodle
CVE-2026-113683

5.1MEDIUM

Key Information:

Vendor

Jcrodriguez-dis

Status
Moodle-mod Vpl
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113683?

The Virtual Programming Lab (VPL) for Moodle prior to version 5.0.0 is susceptible to reflected cross-site scripting (XSS) through the similarity/diff.php component. This vulnerability enables remote attackers to construct malicious links featuring JavaScript payloads. When a user with the mod/vpl:similarity capability accesses one of these links, the script executes in their session context, allowing unauthorized actions or potential data leakage.

Affected Version(s)

moodle-mod_vpl 0 < 5.0.0

References

https://github.com/jcrodriguez-dis/moodle-mod_vpl/commit/...
patch
https://github.com/jcrodriguez-dis/moodle-mod_vpl/release...
release-notes
https://github.com/jcrodriguez-dis/moodle-mod_vpl/blob/V4...
technical-description

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Trần Văn Hoàng
.