by ryan sanders.
site admin menu -> users -> *i forget next link or 2* i want to say permissions or define roles. one of the links there will give you a list of all the permissions to a given role. and it should show a "bit mask" warning signs. i would assume you have given a permission to a role that these students belong to. that has a bit mask, that could allow for XSS security issue.
there are a couple plugins at www.moodle.org/plugins i want to say listed under "admin tools" that might be easier viewing all the permissions vs role and bit mask warning signs vs the default plugin that comes with moodle.