Description
A vulnerability was found in Moodle 3.9 to 3.9.1, 3.8 to 3.8.4 and 3.7 to 3.7.7 where it was possible to include JavaScript in a book's chapter title, which was not escaped on the "Add new chapter" page. This is fixed in 3.9.2, 3.8.5 and 3.7.8.
Remediation
References
Related Vulnerabilities
Joomla Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-8057)
WordPress Plugin CP Contact Form with PayPal Cross-Site Scripting (1.2.97)
OpenSSL Uncontrolled Recursion Vulnerability (CVE-2018-0739)
WordPress Plugin Royal Elementor Addons and Templates Arbitrary File Upload (1.3.78)
WordPress Plugin eHive Account Details Cross-Site Scripting (2.1.2)