XSS HTML encode Payload Bug on Moodle Messages

Dear,

First go to the Messages within the Moodle.  Then Message someone with traditional alert JS.  It will be blocked.  Then let's encode the "<script>alert("Boom")</script>" into HTML encoding "<script>alert("Boom")</script>".  Then it will prompt a Alert Box.  If u continue the testing, .......

So, I've found a Cross Site Scripting Bug in all the universities website using Moodle. 

If you guys consider it as a bug, please don't forget to give a Certificate of Appreciation or other incentive rewards for me.  Unless, it's okay.

Best Regards,

Hein