The vulnerability is a client‑side cross‑site scripting flaw in Moodle LMS 4.0's course search page. Unauthenticated users can submit malicious scripts via the search field in course/search.php. When processed, the scripts run in the victim’s browser context, allowing the attacker to steal session cookies and other sensitive data. This can lead to account hijacking or further actions performed with the victim’s privileges.

Affected products are Moodle LMS, specifically version 4.0. The flaw resides in the core course search functionality. No sub‑version or patch information is provided beyond the main release, so any deployment of Moodle 4.0 before the official fix is vulnerable.

The CVSS score of 5.1 indicates a medium impact; no EPSS data and absence from the CISA KEV catalog suggest limited known exploitation activity. However, the lack of authentication and the simplicity of the attack vector imply that a determined attacker could readily inject payloads from any client with network access to the web interface.