h5p vulnerabilities

CVEs whose affected-version data names the h5p package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

2 CVEsRSS

CVE-2026-112867Medium· 6.5

1w ago

WordPress H5P plugin <= 1.17.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in H5P H5P h5p allows Stored XSS.This issue affects H5P: from n/a through 1.17.9.

▾ SunlitH5P · h5pEPSS 0.17%via CVEORG

CVE-2026-112868Medium· 4.3

2w ago

WordPress H5P plugin <= 1.17.9 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through 1.17.9.

▾ SunlitH5P · h5pEPSS 0.27%via CVEORG