A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and earlier via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content.

The vulnerability affects the Moodle Jmol Plugin, specifically versions 6.1 and earlier. Administrators should verify which version they are running and update accordingly.

The CVSS score of 5.1 reflects a moderate severity, but the EPSS score of < 1% indicates a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, suggesting no known large-scale exploitation. The likely attack vector is a reflected XSS via a crafted URL that an unsuspecting user may click; an attacker could then hijack sessions or alter content. Current evidence of exploitation was observed by the Shadowserver Foundation on 2025-02-02 UTC.