[ CVE-2026-102581 · Published 30 Sep 2026 ]
Vulnerability in moodle
CVSS 5.4
EPSS <1%Fix available
[ Description ]Official description
A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious content into a forum post, which then executes arbitrary script code in the browser of another user viewing the affected post.
[ Fixes ]Fixes and patches
- Patch on git.moodle.orgVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
[ References ]References
- git.moodle.org/gwPatch
- access.redhat.com/security/cve/CVE-2026-102581Third Party Advisory
- bugzilla.redhat.com/show_bug.cgiIssue TrackingThird Party Advisory
- moodle.org/mod/forum/discuss.phpVendor Advisory