VPL (Virtual Programming Lab) for Moodle versions before 5.0.0 includes a reflected cross‑site scripting flaw. An attacker can embed a malicious JavaScript payload into the unvalidated filename parameters used by similarity/diff.php. When a legitimate user with the appropriate mod/vpl:similarity permission opens the crafted link, the script executes within the user’s browser context. This can lead to session hijacking, theft of sensitive data, or arbitrary actions performed as that user. The weakness is an input validation issue identified by CWE‑79.

The vulnerability affects the VPL module for Moodle (mod_vpl) by jcrodriguez-dis. Any installation of this plugin older than version 5.0.0 is potentially impacted. The affected code resides in the similarity/diff.php component of the plugin.

The CVSS score of 5.1 indicates moderate severity, while no EPSS score is available. This vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted URL accessed by a victim user who has permission to view diff reports. Successful exploitation requires that the attacker persuades a user to visit a link containing the malicious payload; if achieved, the attacker can run arbitrary JavaScript under the victim’s session. Even though the score is moderate, the practical impact on confidentiality and integrity remains significant due to the potential for account compromise and unauthorized actions.