H5P vulnerabilities

Versions of H5P up to 1.17.6 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.

The H5P plugin up to version 1.17.9 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. User input is not properly sanitized before being stored.

H5P through 1.17.9 contains an Authorization Bypass Through User-Controlled Key vulnerability that allows exploiting incorrectly configured access control security levels.

The H5P plugin version 1.17.7 and earlier contains a vulnerability allowing a contributor to delete arbitrary files on the server. The flaw is due to insufficient permission validation during file deletion operations.

The H5P plugin (versions up to and including 1.16.1) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects H5P from n/a through 1.16.1.

The H5P plugin (icc0rz) contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through <= 1.16.0.