Skip to main content

Moodle 4.5.11

Security Support Only Moodle Version
This version of Moodle receives security fixes, but is no longer supported for general bug fixes.
You may view the releases page to see the support status of all Moodle versions.

Release date: 20 April 2026

Here is the full list of fixed issues in 4.5.11.

General fixes and improvements​

  • MDL-85352 - Add support for b64_json to the generate_image action in OpenAI provider
  • MDL-88092 - Update H5P library to version 1.28
  • MDL-87482 - Libxml2 >= 2.14.0 breaks messaging
  • MDL-87959 - Moodle LMS to Marketplace integration
  • MDL-87708 - Remove MoodleNet services
  • MDL-87548 - Uploading image from Wikimedia fails on certain images
  • MDL-87100 - Infer upgrade note issue number based on current Git branch

Accessibility fixes and improvements​

  • MDL-77649 - Glossary uses layout tables to render categories and entries
  • MDL-87955 - Accessibility issues on the forum Manage subscribers page
  • MDL-87949 - Insufficient colour contrast when adding Rubric criterion
  • MDL-87993 - Create a screen reader-only toast feature
  • MDL-87810 - Insufficient colour contrast for links in quiz questions and feedback text
  • MDL-81608 - Elements on the Quiz question edit page don't meet WCAG target area requirements
  • MDL-88122 - Empty breadcrumb accessibility issue in course navbar
  • MDL-87600 - Skipped heading levels accessibility issue on user Grades and Preferences pages
  • MDL-85902 - "Next activity" links not structured as navigation areas (9.2 RGAA criteria)
  • MDL-85451 - Incorrect heading levels in Timeline block
  • MDL-77209 - Links within form help popovers should open in a new tab

Security improvements​

  • MDL-83096 - LTI 1.3 new window not triggering completion event
  • MDL-86165 - BigBlueButton recording actions (publish, unpublish, protect, delete, edit, import) are not logged, breaking expected auditability
  • MDL-88145 - cURL security helper method call order check contains a typo

Security fixes​

  • MSA-26-0005 - SQL injection risk in external database authentication plugin
  • MSA-26-0006 - RCE risk via Moodle's Google Drive repository plugin
  • MSA-26-0007 - Message panel breaks with messages from deleted users (messaging DoS risk)
  • MSA-26-0008 - Upgrade PHPUnit version to avoid a security risk (upstream)
  • MSA-26-0010 - Upgrade AWS SDK for PHP including security fix (upstream)
  • MSA-26-0011 - CSRF and missing capability check in admin/mnet/peers.php