CVE-2018-10891: Moodle

High severity, CVSS 7.3. EPSS: 2.1% chance of exploitation in the next 30 days.

A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. When a quiz question bank is imported, it was possible for the question preview that is displayed to execute JavaScript that is written into the question bank.

Affected products

• Moodle Moodle: from 3.1, before 3.1.13 (fixed in 3.1.13); from 3.3, before 3.3.7 (fixed in 3.3.7); from 3.4, before 3.4.4 (fixed in 3.4.4); from 3.5, before 3.5.1 (fixed in 3.5.1)

Published 2018-07-10. Last modified 2026-06-17.