CVE-2025-60507

8.9 highEPSS 0.3%

High (8.9). EPSS 0.3% chance of exploitation in the next 30 days.

Cross site scripting vulnerability in Moodle GeniAI plugin (local_geniai) 2.3.6. An authenticated user with Teacher role can upload a PDF containing embedded JavaScript. The assistant outputs a direct HTML link to the uploaded file without sanitization. When other users (including Students or Administrators) click the link, the payload executes in their browser.

Severity

CVSS 3.1

8.9 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-10-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/onurcangnc/moodle_genai_plugin_xss
https://moodle.org/plugins/local_geniai
https://moodle.org/security/
https://onurcangenc.com.tr/posts/moodle-genia%C4%B1-plugin-vulnerability-stored-reflected-xss-via-pdf-upload-and-chatbot-%C4%B1nput/

Check your stack JSON