A cross-site scripting vulnerability in Moodle allows authenticated users to execute malicious scripts, potentially leading to session theft and interface manipulation.

The vulnerability is a Stored Cross-site Scripting (XSS) flaw caused by improper sanitization of AI-generated content. An authenticated user can inject malicious scripts that execute in the context of other users' sessions when they view the compromised pages.

Successful exploitation of this vulnerability allows an attacker to compromise user sessions, potentially leading to unauthorized account access or data exfiltration. With a CVSS score of 7.3, this high-severity flaw poses a significant risk to the integrity of the Moodle platform and the confidentiality of user interactions within the learning environment.

Immediate Action: Update Moodle installations to the patched versions: 4.1.22, 4.4.12, 4.5.8, or 5.0.4 as appropriate for your branch.

Proactive Monitoring: Monitor web application logs for unusual script injections, particularly within AI-generated content modules or user-submitted prompts.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) configured to detect and block common XSS payloads.

Public Exploit Available: No

Given the potential for session hijacking and unauthorized interface manipulation, administrators should prioritize applying the provided security patches across all affected Moodle instances. Ensuring that the software is updated to the latest supported versions is essential to mitigating this risk and maintaining the security of the institutional learning environment.