Moodle stored XSS via calendar's event title when deleting the event

MEDIUM 6.1CVE-2024-38274 · BIT-moodle-2024-38274 · GHSA-p5cg-6rfr-6mx8 · Published 18/06/2024 · updated 17/06/2026

In short

CVE-2024-38274 is a MEDIUM (CVSS 6.1) vulnerability affecting moodle/moodle, moodle (moodle).
Chance of exploitation in the next 30 days (EPSS): 0.38%, higher than 31.7% of all vulnerabilities.
Fix: update to 4.2.8, 4.3.5, 4.4.1, 4.1.11 or later.

Package	Affected versions	Patched versions
moodle/moodle Packagist	`≥ 4.2.0-beta, < 4.2.8≥ 4.3.0-beta, < 4.3.5≥ 4.4.0-beta, < 4.4.1< 4.1.11`	`4.2.84.3.54.4.14.1.11`
moodle moodle	`= 4.4.0≥ 4.1.0, < 4.1.11≥ 4.2.0, < 4.2.8≥ 4.3.0, < 4.3.5`	`4.1.114.2.84.3.5`

Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt.

NVD description

Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Packagist

≥ 4.2.0-beta, < 4.2.8≥ 4.3.0-beta, < 4.3.5≥ 4.4.0-beta, < 4.4.1< 4.1.11

4.2.84.3.54.4.14.1.11

= 4.4.0≥ 4.1.0, < 4.1.11≥ 4.2.0, < 4.2.8≥ 4.3.0, < 4.3.5

4.1.114.2.84.3.5

More vulnerabilities in moodle/moodle

See all →