CVE-2026-102581: Moodle: xss in forum post templates due to insufficient escaping
A flaw was found in Moodle. Insufficient escaping in templates used to display forum posts resulted in a cross-site scripting (XSS) risk, allowing a stored script to execute in the browser of another user who views the affected forum post.
Other sources
A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious content into a forum post, which then executes arbitrary script code in the browser of another user viewing the affected post.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs privileges to create or edit a forum post and must be able to inject malicious content into that post. Exploitation also requires another user to view the affected forum post.
What is the likely impact on users who view a malicious post?
The stored script can execute in the viewing user's browser. The provided severity vector indicates low confidentiality and integrity impact, with no availability impact.
How can administrators identify potential exposure?
Review forum posts for suspicious or unexpected embedded content, particularly posts created by users with forum posting privileges. The issue is associated with templates used to display forum posts.