CVE-2025-62951: WordPress H5P plugin <= 1.16.0 - Cross Site Scripting (XSS) vulnerability
Published Oct 27, 2025
·Updated
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icc0rz H5P h5p allows Stored XSS.This issue affects H5P: from n/a through <= 1.16.0.
Affected Software
2 affected components
H5P H5P<=1.16.0
wordpress/h5p<=1.16.0
Event History
Oct 27, 2025
CVE Published
via MITRE·01:34 AM
Data Sourced
via MITRE·01:34 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-62951?
CVE-2025-62951 has been classified with a high severity due to its potential for enabling stored cross-site scripting attacks.
2
How do I fix CVE-2025-62951?
To fix CVE-2025-62951, upgrade to Interactive Content – H5P version 1.16.1 or later.
3
What versions are affected by CVE-2025-62951?
CVE-2025-62951 affects Interactive Content – H5P versions from n/a through 1.16.0.
4
What type of vulnerability is CVE-2025-62951?
CVE-2025-62951 is a vulnerability that involves improper neutralization of input during web page generation, specifically leading to stored cross-site scripting.
5
Who is impacted by CVE-2025-62951?
Users of Interactive Content – H5P version 1.16.0 or earlier are impacted by CVE-2025-62951.