GHSA-p5cg-6rfr-6mx8

GitHub Security Advisory

Moodle stored XSS via calendar's event title when deleting the event

✓ GitHub Reviewed MODERATE Has CVE

Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt.

Packagist moodle/moodle

Affected versions: 4.4.0-beta (fixed in 4.4.1)

Packagist moodle/moodle

Affected versions: 4.3.0-beta (fixed in 4.3.5)

Packagist moodle/moodle

Affected versions: 4.2.0-beta (fixed in 4.2.8)

Packagist moodle/moodle

Affected versions: 0 (fixed in 4.1.11)

CVE-2024-38274

GHSA ID

GHSA-p5cg-6rfr-6mx8

Published

June 18, 2024 9:30 PM

Last Modified

June 27, 2024 3:30 AM

CVSS Score

5.0 /10

Primary Ecosystem

Packagist

Primary Package

moodle/moodle

GitHub Reviewed

✓ Yes

Last updated: September 14, 2025 6:31 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.