CVE-2025-60506

Moodle PDF Annotator plugin v1.5 release 9 allows stored cross-site scripting (XSS) via the Public Comments feature. An attacker with a low-privileged account (e.g., Student) can inject arbitrary JavaScript payloads into a comment. When any other user (Student, Teacher, or Admin) views the annotated PDF, the payload is executed in their browser, leading to session hijacking, credential theft, or other attacker-controlled actions.

• CWE-79

• https://github.com/onurcangnc/moodle-xss-pdfannotator
• https://onurcangenc.com.tr/blog/moodle-xss-pdfannotator
• https://onurcangenc.com.tr/posts/cve-2025-60506-stored-cross-site-scripting-xss-in-moodle-pdf-annotator-plugin-v1-5-release-9/
• https://onurcangenc.com.tr/posts/cve-2025-60506-stored-cross-site-scripting-xss-in-moodle-pdf-annotator-plugin-v1-5-release-9/

Published

Oct 21, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-60485A segmentation violation in the gf_isom_apple_set_tag_ex fun…5.5
• CVE-2025-60486A heap use-after-free in the dasher_process function (/filte…5.5
• CVE-2025-60495A segmentation violation in the gf_media_get_color_info func…5.5
• CVE-2025-6050Mezzanine CMS, in versions prior to 6.1.1, contains a Stored…4.8
• CVE-2025-60500QDocs Smart School Management System 7.1 allows authenticate…7.2
• CVE-2025-60503A cross-site scripting (XSS) vulnerability exists in the adm…8.7
• CVE-2025-60507Cross site scripting vulnerability in Moodle GeniAI plugin (…8.9
• CVE-2025-6051A Regular Expression Denial of Service (ReDoS) vulnerability…5.3
• CVE-2025-60511Moodle OpenAI Chat Block plugin 3.0.1 (2025021700) suffers f…4.3
• CVE-2025-60514Tillywork v0.1.3 and below is vulnerable to SQL Injection in…6.5
• CVE-2025-6052A flaw was found in how GLib’s GString manages memory when a…7.5
• CVE-2025-6053The Zuppler Online Ordering plugin for WordPress is vulnerab…6.1