CVE-2020-25627: Moodle

Medium severity, CVSS 6.1. EPSS: 3.7% chance of exploitation in the next 30 days.

The moodlenetprofile user profile field required extra sanitizing to prevent a stored XSS risk. This affects versions 3.9 to 3.9.1. Fixed in 3.9.2.

Affected products

• Moodle Moodle: from 3.9.0, before 3.9.2 (fixed in 3.9.2)

Published 2020-12-09. Last modified 2026-06-17.