Vulnerability Description
Cross site scripting vulnerability in Moodle GeniAI plugin (local_geniai) 2.3.6. An authenticated user with Teacher role can upload a PDF containing embedded JavaScript. The assistant outputs a direct HTML link to the uploaded file without sanitization. When other users (including Students or Administrators) click the link, the payload executes in their browser.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/onurcangnc/moodle_genai_plugin_xss
- https://moodle.org/plugins/local_geniai
- https://moodle.org/security/
- https://onurcangenc.com.tr/posts/moodle-genia%C4%B1-plugin-vulnerability-stored-
FAQ
What is CVE-2025-60507?
CVE-2025-60507 is a vulnerability with a CVSS score of 8.9 (HIGH). Cross site scripting vulnerability in Moodle GeniAI plugin (local_geniai) 2.3.6. An authenticated user with Teacher role can upload a PDF containing embedded JavaScript. The assistant outputs a direct...
How severe is CVE-2025-60507?
CVE-2025-60507 has been rated HIGH with a CVSS base score of 8.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-60507?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.