The Moodle GeniAI plugin is vulnerable to stored cross-site scripting, which allows authenticated attackers to execute arbitrary JavaScript in the context of other users' browser sessions.

This is a stored cross-site scripting (XSS) vulnerability occurring when an authenticated user with the Teacher role uploads a malicious PDF containing embedded JavaScript. The plugin fails to sanitize the output, causing the payload to execute when other users, including administrators, interact with the generated file link.

Successful exploitation of this vulnerability can lead to unauthorized access to user accounts, session hijacking, or the execution of malicious actions on behalf of privileged users, such as site administrators. Given the CVSS score of 8.9, the risk is high as it permits lateral movement within the platform and compromises the integrity of the Moodle environment.

Immediate Action: Update the Moodle GeniAI plugin to the latest available version that addresses this sanitization flaw. If an update is not immediately available, disable the plugin to prevent further exploitation.

Proactive Monitoring: Review web server and Moodle application logs for anomalous file upload patterns or suspicious JavaScript payloads embedded within file names or chatbot interactions.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block malicious script injection attempts, and restrict the ability to upload files for untrusted or unauthorized accounts.

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the researcher's technical write-up on GitHub.

The severity of this vulnerability, combined with the availability of a proof-of-concept, necessitates immediate action. Administrators must prioritize updating the GeniAI plugin to ensure that malicious JavaScript cannot be injected and executed. If patching is not feasible, restricting plugin access or disabling the component is required to protect the integrity of your Moodle instance and its users.