CVE-2026-102586
Moodle: cross-site scripting
- Risk score
- 40/100
- CVSS
- 6.1 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 30 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary script in the victim's…
- Affected
- Moodle
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Moodle: Yellow, plan it in. A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This issue could allow an attacker to view, alter, or delete sensitive data stored in t…
The flaws
- CVE-2026-102586: Cross-site scripting (CVSS 6.1 · EPSS 0%)
- CVE-2026-102578: SQL injection (CVSS 8.8 · EPSS 0%)
- CVE-2026-102588: A flaw was found in Moodle (CVSS 6.5 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Moodle
Where it stands
- No known exploitation
Connects to
- Same weakness: Cross-site scripting (CWE-79). 399 other warnings in 30 days
- Same product: Earlier Moodle warnings. 9 in the last 90 days
Why it is Yellow
- CVSS 6.1 medium
References
Original description
A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary script in the victim's browser.
Last activity 30 Sep 2026. Patch Forecast updates every hour.