PT-2025-42919 · WordPress · Moodle Geniai Plugin+1

Published 2025-10-21 · Updated 2025-10-21 · CVE-2025-60507

Positive Technologies (AI Summary)

CVSS v3.1

8.9

High

Base vector

AC:L/AV:N/A:L/C:H/I:H/PR:L/S:C/UI:R

Name of the Vulnerable Software and Affected Versions Moodle GeniAI plugin (local geniai) version 2.3.6

Description A cross-site scripting issue exists in the Moodle GeniAI plugin (local geniai). An authenticated user with Teacher role can upload a PDF file containing embedded JavaScript. The plugin generates a direct HTML link to the uploaded file without proper sanitization. When other users click this link, the JavaScript code executes in their browser. The vulnerable component is local geniai.

Recommendations Update to a newer version of the Moodle GeniAI plugin that addresses this issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-60507

Affected Products

Moodle Geniai Plugin

Local Geniai

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-60507 · Security Note
• https://moodle.org/security · Note
• https://twitter.com/onurcangenc1999/status/1980728473674039445 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1980708715851338195 · Twitter Post
• https://github.com/onurcangnc/moodle_genai_plugin_xss · Note
• https://twitter.com/CveFindCom/status/1980698002952957980 · Twitter Post
• https://onurcangenc.com.tr/posts/moodle-genia%C4%B1-plugin-vulnerability-stored-reflected-xss-via-pdf-upload-and-chatbot-%C4%B1nput · Note
• https://twitter.com/CveTodo/status/1980702721800847817 · Twitter Post
• https://moodle.org/plugins/local_geniai · Note
• https://twitter.com/CVEnew/status/1980700953847189906 · Twitter Post