Is CVE-2026-102586 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-102586?

CVE-2026-102586 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-102586

Description

A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary script in the victim's browser.