# CVE-2026-112867: H5P stored cross-site scripting in content creation

Source: https://junglewise.ai/threats/cve-2026-112867-improper-neutralization-of-input-during-web-page-generation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-112867 · Severity: medium · CVSS 6.5 · Published 2026-10-22

H5P is a WordPress plugin that allows educators and content creators to build interactive learning content. A stored cross-site scripting vulnerability in versions through 1.17.9 allows contributors to inject malicious scripts that execute in the browsers of visitors viewing the content, potentially stealing data or hijacking accounts. The issue requires a contributor to craft and store the malicious content but affects all subsequent viewers of that content.

Technologies: [H5P](https://junglewise.ai/threats/technologies/h5p). Vendors: [H5P](https://junglewise.ai/threats/vendors/h5p).

## Quick answers

**Is CVE-2026-112867 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112867 being exploited in the wild.

**How severe is CVE-2026-112867?** Medium severity, with a CVSS score of 6.5, published 22 October 2026.

**Which products and versions are affected?** H5P through 1.17.9.

**Is there a fix for CVE-2026-112867?** Yes: fixed in 1.17.10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112867 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-112867?** Check whether you run H5P at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.17.10

## Technical details

Stored XSS vulnerability in H5P WordPress plugin through 1.17.9 resulting from improper input sanitization during web page generation. Attack requires authenticated contributor-level privileges to inject a malicious payload via content creation; the script persists and executes for all users viewing the affected content. Exploitation does not require user interaction beyond visiting a page with the malicious content.

## Affected products

- H5P H5P through 1.17.9

## Timeline

- 2026-09-20: disclosed: Reported by Intrudify
- 2026-10-22: advisory: Published by Patchstack and NVD
- 2026-10-22: patched: Version 1.17.10 released

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/h5p/vulnerability/wordpress-h5p-plugin-1-17-9-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/h5p/vulnerability/wordpress-h5p-plugin-1-17-9-cross-site-scripting-xss-vulnerability?_s_id=cve)

## Related threats

- [H5P WordPress plugin unauthenticated XSS](https://junglewise.ai/threats/cve-2026-56006-h5p-wordpress-plugin-unauthenticated-xss)