CVE-2014-3551: Multiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle throug...

Security readout for executives and security teams

CVE-2014-3551 is an authenticated Moodle XSS issue in advanced grading rubrics. A user with access to submit crafted rubric qualification or rating content could cause script or HTML to run in another user's browser. This is mainly a session, trust, and content-integrity risk, not a server takeover based on the provided sources. Exposure is likely limited to Moodle sites running the listed older versions with advanced grading rubrics enabled or accessible. The attacker must be authenticated, so risk depends on account availability, course roles, and who later views the crafted rubric content. Prioritize remediation for internet-facing or broadly accessible Moodle deployments, especially where many students or external users have accounts. The issue is old and authenticated, but XSS can still affect privileged users who review grading content. Mitigation focus: Upgrade affected Moodle branches to fixed or later supported releases.; Retire Moodle 2.3.x systems covered through 2.3.11.; Review Moodle's MDL-46223 and security notification guidance..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.