Mahara allows a reflected cross‑site scripting attack when users submit a malicious query through its ‘search site’ feature. The Elasticsearch7 plugin used by the platform fails to sanitize the search string, causing user‑controlled input to be rendered in the search results. This flaw can be exploited to run arbitrary JavaScript in the context of a victim’s browser.

The issue is present in Mahara releases before 25.04.2 and before 24.04.11 when the Elasticsearch7 search plugin is enabled. Any system running these versions and exposing the search feature to external users is vulnerable.

The CVSS score of 6.1 indicates a moderate severity, but the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV inventory. Attackers can trigger the flaw remotely by sending a crafted search query from an external source, and the impact depends on the user's session privileges and the web console’s execution context.