All vulnerabilities
CVE-2026-102586

Moodle: xss via password reset link due to insufficient username escaping

Unknown productApplications & CMS
Open in ThreatlineRecord JSON
CVSS
4.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.28%Chance of exploitation activity in the next 30 days, higher than 19% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.2.2Also 5.1.6, 5.0.9 and 1 moreCVE List
Published30 Sep 2026Updated 30 Sep 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary script in the victim's browser.

Text from CVE List

Affected versions 4

  • Productaffected: 5.2.0 before 5.2.2CVE List
  • Productaffected: 5.1.0 before 5.1.6CVE List
  • Productaffected: 5.0.0 before 5.0.9CVE List
  • Productaffected: all versions before 4.5.13CVE List

References 3