CVE-2025-60506: XSS
Moodle PDF Annotator plugin v1.5 release 9 allows stored cross-site scripting (XSS) via the Public Comments feature. An attacker with a low-privileged account (e.g., Student) can inject arbitrary JavaScript payloads into a comment. When any other user (Student, Teacher, or Admin) views the annotated PDF, the payload is executed in their browser, leading to session hijacking, credential theft, or other attacker-controlled actions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-60506?
CVE-2025-60506 is classified as a high severity vulnerability due to its potential for stored cross-site scripting (XSS).
How do I fix CVE-2025-60506?
To mitigate CVE-2025-60506, update the Moodle PDF Annotator plugin to a version that addresses the XSS vulnerability.
Who is affected by CVE-2025-60506?
CVE-2025-60506 affects users of the Moodle PDF Annotator plugin version 1.5 release 9, including Students, Teachers, and Admins.
What type of vulnerability is CVE-2025-60506?
CVE-2025-60506 is a stored cross-site scripting (XSS) vulnerability that allows attackers to inject JavaScript into comments.
Can a low-privileged user exploit CVE-2025-60506?
Yes, a low-privileged user such as a Student can exploit CVE-2025-60506 by injecting malicious scripts into public comments.