CVE-2025-26528: Stored XSS in ddimageortext question type
The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.1.16 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.3.10 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.4.6 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.5.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26528?
CVE-2025-26528 has been classified as a medium severity vulnerability due to its potential for stored cross-site scripting (XSS) attacks.
How do I fix CVE-2025-26528?
To fix CVE-2025-26528, upgrade your Moodle installation to version 4.1.16 or later, or to any of the patched versions specified.
What does CVE-2025-26528 affect?
CVE-2025-26528 affects specific versions of Moodle, primarily those prior to 4.1.16, and between versions 4.3.0-beta and 4.3.10, 4.4.0-beta and 4.4.6, and 4.5.0-beta and 4.5.2.
Is it possible to exploit CVE-2025-26528?
Yes, CVE-2025-26528 can be exploited by attackers to execute malicious scripts in the context of a user's session through stored XSS.
What is the nature of the vulnerability in CVE-2025-26528?
CVE-2025-26528 is a stored XSS vulnerability that requires additional sanitization of user input on the drag-and-drop onto image question type.