CVE-2026-112867
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The H5P plugin up to version 1.17.9 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. User input is not properly sanitized before being stored.
Risk Assessment
An attacker can store malicious JavaScript that executes for other users, enabling session theft or other actions within the site context.
Recommendation
Update the H5P plugin to a version later than 1.17.9 or disable it if updating is not possible.
Other vulnerabilities in H5P
See all- CVE-2026-56006High
Versions of H5P up to 1.17.6 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
- CVE-2026-112868Medium
H5P through 1.17.9 contains an Authorization Bypass Through User-Controlled Key vulnerability that allows exploiting incorrectly configured access control security levels.
- CVE-2026-57321High
The H5P plugin version 1.17.7 and earlier contains a vulnerability allowing a contributor to delete arbitrary files on the server. The flaw is due to insufficient permission validation during file deletion operations.
- CVE-2025-68505Medium
The H5P plugin (versions up to and including 1.16.1) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects H5P from n/a through 1.16.1.
- CVE-2025-62951Medium
The H5P plugin (icc0rz) contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through <= 1.16.0.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in H5P H5P h5p allows Stored XSS.This issue affects H5P: from n/a through 1.17.9.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS