CVE-2014-9059: lib/setup.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does...

Security readout for executives and security teams

Older Moodle versions may send some AJAX responses without telling browsers the character set. In certain browser/content handling conditions, UTF-7 encoded text could be interpreted as script, creating an XSS risk. Successful abuse could affect users interacting with the Moodle site, including session or account actions available to that user. Exposure is most likely in legacy Moodle deployments running the listed vulnerable versions, especially internet-facing learning portals. Current Moodle installations outside those version ranges are not shown as affected by the provided sources. Medium priority for organizations still operating old Moodle versions. The business risk is user-facing XSS on learning platforms, not confirmed widespread exploitation. Patch or retire affected legacy deployments during the next security maintenance window, faster if internet-facing or handling sensitive student data. Mitigation focus: Upgrade affected Moodle branches to a fixed or vendor-supported release.; Confirm Moodle 2.5.x is at least 2.5.9.; Confirm Moodle 2.6.x is at least 2.6.6..

Prepared

Jun 14, 2026, 06:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.