Moodle · Moodle · CVE-2026-102586
**Name of the Vulnerable Software and Affected Versions**
Moodle (affected versions not specified)
**Description**
Insufficient sanitization of the `username` input on the password reset page allows a remote attacker to perform a cross-site scripting (XSS) attack. XSS is a flaw where malicious scripts are injected into trusted websites. An attacker can execute arbitrary scripts in the browser of an unauthenticated user by tricking them into clicking a specially crafted password reset link.
**Recommendations**
At the moment, there is no information about a newer version that contains a fix for this vulnerability.