All vulnerabilities
CVE-2026-102581

Moodle: xss in forum post templates due to insufficient escaping

Unknown productApplications & CMS
Open in ThreatlineRecord JSON
CVSS
4.6Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.2.2Also 5.1.6, 5.0.9 and 1 moreCVE List
Published30 Sep 2026Updated 30 Sep 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious content into a forum post, which then executes arbitrary script code in the browser of another user viewing the affected post.

Text from CVE List

Affected versions 4

  • Productaffected: 5.2.0 before 5.2.2CVE List
  • Productaffected: 5.1.0 before 5.1.6CVE List
  • Productaffected: 5.0.0 before 5.0.9CVE List
  • Productaffected: all versions before 4.5.13CVE List

References 3