Read the docs

H5P

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

H5P records in CISA KEV

No H5P vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
H5p 1 record MEDIUM

Records

4 records

TI-2024-02913 CVE-2024-3111 · GHSA-p658-759g-r8hf

H5P < 1.15.8 - Contributor+ Stored XSS

Priority MEDIUM 64

The Interactive Content WordPress plugin before 1.15.8 does not validate uploads which could allow a Contributors and above to update malicious SVG files, leading to Stored Cross-Site Scripting issues

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00315 Published 2024-06-27 Fixed in 1.15.8 CWE-79
TI-2026-79207 CVE-2026-112867 · GHSA-px3h-x9p7-gjv8

Stored cross-site scripting in WordPress H5P plugin

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in H5P H5P h5p allows Stored XSS.This issue affects H5P: from n/a through 1.17.9.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0017 Published 2026-10-22 No fix listed CWE-79
TI-2026-78922 CVE-2026-112868 · GHSA-vc4c-mh3j-3h84

Authorization bypass in WordPress H5P plugin

Priority LOW 20

Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through 1.17.9.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00274 Published 2026-10-21 No fix listed CWE-639
Open these records in search →