Live › vulnerability › CVE-2026-112867
Go to dashboardH5P versions up to and including 1.17.9 fail to neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can store crafted content can run JavaScript in the browser of users who view it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites and applications that run H5P and let users create or edit H5P content that other users view. Installs that do not use H5P, or where only trusted administrators can author content, are less exposed. The sources do not give further detail on the data path.
No product ranges from the sources yet.
1.17.91.17.9; the sources do not name the fixed releaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in H5P H5P h5p allows Stored XSS.This issue affects H5P: from n/a through 1.17.9.
This page as .md · .json · in your agent: get_signal("CVE-2026-112867")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.