Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: H5P Clear all filters
TI-2026-79207 CVE-2026-112867 · GHSA-px3h-x9p7-gjv8

Stored cross-site scripting in WordPress H5P plugin

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in H5P H5P h5p allows Stored XSS.This issue affects H5P: from n/a through 1.17.9.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0017 Published 2026-10-22 No fix listed CWE-79
TI-2026-78922 CVE-2026-112868 · GHSA-vc4c-mh3j-3h84

Authorization bypass in WordPress H5P plugin

Priority LOW 20

Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through 1.17.9.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00274 Published 2026-10-21 No fix listed CWE-639
TI-2024-02913 CVE-2024-3111 · GHSA-p658-759g-r8hf

H5P < 1.15.8 - Contributor+ Stored XSS

Priority MEDIUM 64

The Interactive Content WordPress plugin before 1.15.8 does not validate uploads which could allow a Contributors and above to update malicious SVG files, leading to Stored Cross-Site Scripting issues

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00315 Published 2024-06-27 Fixed in 1.15.8 CWE-79