CVE-2026-112867: WordPress H5P plugin <= 1.17.9 - Cross Site Scripting (XSS) vulnerability

Q: What level of access does an attacker need to exploit this issue?

The attack vector indicates that an attacker needs at least low-level privileges in the WordPress environment. Exploitation also requires user interaction.

Q: What could successful exploitation allow?

This is a stored cross-site scripting issue, meaning injected script may be retained and later executed when a user views affected content. The supplied impact metrics indicate low confidentiality, integrity, and availability impact, with scope changed.

Q: Which H5P plugin versions are affected?

The issue affects the H5P WordPress plugin through version 1.17.9. The provided data does not identify a fixed version.

Published Oct 22, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in H5P H5P h5p allows Stored XSS.This issue affects H5P: from n/a through 1.17.9.

Affected Software

1 affected component

H5P H5P WordPress plugin<=1.17.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress H5P plugin to a version that resolves this vulnerability.
Fixed in 1.17.10

Event History

Oct 22, 2026

CVE Published

via MITRE·06:46 AM

Data Sourced

via MITRE·06:46 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The attack vector indicates that an attacker needs at least low-level privileges in the WordPress environment. Exploitation also requires user interaction.

What could successful exploitation allow?