H5P WordPress Plugin CVE-2026-112867

Exploitation requires an existing authenticated WordPress account with at least low-level privileges (PR:L) capable of creating or editing H5P interactive content, and the stored payload only executes when a victim user (such as an administrator) subsequently views the attacker-controlled content in their browser (UI:R). Limiting factors: no unauthenticated path exists, so sites that do not grant content-authoring roles to untrusted users face substantially reduced risk; successful impact depends on a privileged victim actually rendering the injected content. All H5P plugin versions from the earliest affected through 1.17.9 are vulnerable.

This is a moderate-severity Stored XSS (CWE-79) in the H5P WordPress plugin, rated CVSS 6.5 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The signals are internally consistent and point to a genuine but bounded risk rather than a top-tier emergency. PR:L confirms the attacker must already hold a low-privileged authenticated account on the WordPress site, and UI:R means a victim (typically an admin or other user) must view the attacker-injected content to trigger execution; these two factors materially reduce real-world exploitability compared to an unauthenticated flaw. The scope change (S:C) and low C/I/A impacts are typical of stored XSS, where injected script executes in the victim's browser session and can lead to session/cookie theft, admin action forgery, or further privilege escalation. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active or widespread exploitation - this should be treated as a patch-in-normal-cycle item, prioritized higher only on sites that allow untrusted low-privilege contributors. EPSS and KEV data are absent from the input (not confirmed negative), so exploitation probability cannot be quantified from the data given.

A low-privileged authenticated user (e.g. a contributor or author account) injects malicious JavaScript into an H5P interactive content field that is not properly neutralized. When an administrator or other user later opens or previews that content in wp-admin, the script executes in their browser session, enabling session hijacking or forged administrative actions. No public exploit code was identified in the provided data, though stored XSS in Patchstack-tracked WordPress plugins is generally straightforward to weaponize.