H5P has 2 CVEs on record. 2 were published in the last 90 days. The median CVSS is 5.4 (medium).

CVEs per month

Last 12 months, by publish date

1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10

Exploited share: 0% vs 1% corpus
Median CVSS: 5.4
Publish → KEV: —
Last 90 days: 2 prev 0

Weakness classes

Products

h5p 2

Follow H5P:RSS feed Save a search →Embed badge ↗

Total CVEs

Critical

CISA KEV

Exploited

Worst active — by depth score

CVE-2026-112867Medium· 6.5WordPress H5P plugin <= 1.17.9 - Cross Site Scripting (XSS) vulnerability36
CVE-2026-112868Medium· 4.3WordPress H5P plugin <= 1.17.9 - Insecure Direct Object References (IDOR) vulnerability24

H5P vulnerabilities

CVEs affecting H5P, newest first. Open any entry for full detail, references, and exploit status.

2 CVEsRSS

CVE-2026-112867Medium· 6.5

yesterday

WordPress H5P plugin <= 1.17.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in H5P H5P h5p allows Stored XSS.This issue affects H5P: from n/a through 1.17.9.

▾ SunlitH5P · h5pvia CVEORG

CVE-2026-112868Medium· 4.3

2d ago

WordPress H5P plugin <= 1.17.9 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through 1.17.9.

▾ SunlitH5P · h5pvia CVEORG