CVE-2025-60506

The Moodle PDF Annotator plugin v1.5 release 9 is vulnerable to stored cross-site scripting (XSS) via the Public Comments feature. The root cause is the failure to properly filter input, allowing an attacker with a low-privileged account (e.g., a Student) to inject arbitrary JavaScript payloads i...