CVE-2026-102586

Name of the Vulnerable Software and Affected Versions Moodle (affected versions not specified)

Description Insufficient sanitization of the username input on the password reset page allows a remote attacker to perform a cross-site scripting (XSS) attack. XSS is a flaw where malicious scripts are injected into trusted websites. An attacker can execute arbitrary scripts in the browser of an unauthenticated user by tricking them into clicking a specially crafted password reset link.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.