What is the CVSS score of CVE-2026-56006?

CVE-2026-56006 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of H5P are affected by CVE-2026-56006?

The H5P WordPress plugin (versions 1.17.6 and earlier) contains a reflected cross-site scripting vulnerability (CVE-2026-56006, CVSS 7.1) that allows unauthenticated attackers to compromise…

How to fix or mitigate CVE-2026-56006?

WITHIN 24 HOURS: Audit all WordPress installations to identify those running H5P plugin version 1.17.6 or earlier; document counts and affected sites. WITHIN 7 DAYS: Deploy Web Application Firewall (WAF) rules blocking script injection patterns on H5P endpoints; implement Content Security Policy (CSP) headers restricting inline script execution; enable multi-factor authentication on all WordPress administrator accounts. WITHIN 30 DAYS: Monitor the H5P project and Automattic security advisories for a patched version; prepare upgrade plan and test in staging environment immediately upon patch release. If H5P functionality is not mission-critical, consider temporary plugin disablement until patched version is confirmed stable.

H5P CVE-2026-56006

EUVD-2026-39375 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-25 Patchstack

GHSA-rp27-rcxx-mqmc

WordPress XSS Wordpress Plugin H5P

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network-reachable reflected XSS (PR:N, AV:N, AC:L) requires a victim click (UI:R); execution in the browser session crosses a security boundary (S:C) with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:21 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in H5P <= 1.17.6 versions.

AnalysisAI

Reflected cross-site scripting in the H5P WordPress plugin (versions 1.17.6 and earlier) lets an unauthenticated attacker inject script that executes in a victim's browser when they follow a crafted link, per the CVSS PR:N/UI:R vector. Because the scope is changed (S:C), successful execution can reach beyond the vulnerable component into the authenticated WordPress session context, enabling session/cookie theft or admin-context actions. There is no public exploit identified and the issue is not listed in CISA KEV, so risk is moderate (CVSS 7.1) and contingent on social-engineering a logged-in user.

Technical ContextAI

H5P is a WordPress plugin (CPE cpe:2.3:a:h5p:h5p) used to author and embed interactive HTML5 learning content (quizzes, presentations, interactive video) inside WordPress sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): attacker-controlled input is reflected back into an HTTP response without proper output encoding or input sanitization, so it is rendered by the browser as active markup/script rather than inert text. As a reflected variant, the payload is not stored server-side but delivered within a request (e.g., a URL parameter) and echoed into the page returned to the requester.

RemediationAI

No vendor-released patch version was identified in the available data; the input confirms only that versions up to and including 1.17.6 are affected, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/h5p/vulnerability/wordpress-h5p-plugin-1-17-6-reflected-cross-site-scripting-xss-vulnerability) and the WordPress plugin repository for any release newer than 1.17.6 and upgrade to it once confirmed. Until a fixed version is verified, deactivate the H5P plugin if interactive content is non-essential (trade-off: H5P content stops rendering), or place a Web Application Firewall (e.g., Patchstack/Wordfence virtual patch) in front of the site to filter reflected XSS payloads in request parameters (trade-off: rule gaps may still allow novel payloads). As defense-in-depth, set a restrictive Content-Security-Policy to limit inline script execution and the HttpOnly/SameSite flags on session cookies to blunt session theft (trade-off: a strict CSP may break legitimate inline scripts used by H5P content).