CVE-2021-36403: Moodle

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk.

Affected products

• Moodle Moodle: before 3.9.8 (fixed in 3.9.8); from 3.10.0, before 3.10.5 (fixed in 3.10.5); from 3.11.0, before 3.11.1 (fixed in 3.11.1)

Published 2023-03-06. Last modified 2026-06-17.