CVE-2021-26812: Jitsi Meet Moodle plugin XSS via sessionpriv.php

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityPublic exploit references and a very high EPSS score indicate active interest, though the flaw requires user interaction and yields limited direct impact.

What it is

The Jitsi Meet plugin for Moodle (versions 2.7 through 2.8.3) contains a reflected cross-site scripting flaw in the sessionpriv.php module. An attacker can craft a malicious URL that, when clicked by a user, injects JavaScript executed in the context of the application. Because the plugin runs inside Moodle, successful exploitation can compromise the user's session in that environment.

Impact

An attacker can execute arbitrary JavaScript in a victim's browser session, potentially stealing session cookies or tokens and performing actions as the victim within Moodle. The CVSS scope change (S:C) indicates impact can extend beyond the vulnerable component.

Attack surface

Reached over the network via a crafted URL pointing at the sessionpriv.php module; no authentication is required to deliver the link, but the victim must click it (UI:R). The attack is reflected XSS, so it depends on user interaction rather than direct server access.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.97157, 99.89th percentile), indicating elevated likelihood of exploitation activity. Both references are tagged Exploit, confirming public exploit information exists.

What to do

• Update the Jitsi Meet plugin for Moodle to a version later than 2.8.3, or apply the vendor fix referenced in the GitHub issue.
• If patching is not immediately possible, disable or restrict the plugin's sessionpriv.php endpoint.
• Deploy a web application firewall rule to block script payloads targeting sessionpriv.php.
• Enforce HttpOnly and Secure flags on session cookies to limit token theft via XSS.
• Review Moodle plugin inventory to confirm which sites run affected versions.

Detection

• Search web and proxy logs for requests to sessionpriv.php containing script tags or encoded JavaScript in parameters.
• Monitor for anomalous JavaScript execution or unexpected outbound requests originating from Moodle sessions.
• Alert on repeated access to sessionpriv.php URLs from external referrers or unusual user agents.
• Correlate Moodle session activity with indicators of cookie or token exfiltration.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.