{"id":"CVE-2026-112867","kind":"vulnerability","aliases":["CVE-2026-112867"],"related":[],"title":"H5P: stored cross-site scripting through unsanitized input up to 1.17.9","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in H5P H5P h5p allows Stored XSS.This issue affects H5P: from n/a through 1.17.9.","summary":"H5P versions up to and including 1.17.9 fail to neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can store crafted content can run JavaScript in the browser of users who view it.","severity":"medium","cvss":6.5,"epss":0.0013,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","h5p","package","self-hosted","wordpress"],"not_affected_if":["h5p-not-installed","trusted-authors-only"],"how_to_check":"- Check the installed H5P plugin or library version against `1.17.9`\n- Look at the H5P package version in the project's dependency or plugin manifest, if one is used","fix":"- Upgrade H5P to a version later than `1.17.9`; the sources do not name the fixed release\n- Until patched, restrict who can create or edit H5P content","status":"open","published_at":"2026-10-22T07:16:41+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:47:34+00:00","updated_at":"2026-10-25T03:47:34+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:47:34Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade H5P to a version later than `1.17.9`; the sources do not name the fixed release\n- Until patched, restrict who can create or edit H5P content","reach":"internet","title":"H5P: stored cross-site scripting through unsanitized input up to 1.17.9","impact":"medium","summary":"H5P versions up to and including 1.17.9 fail to neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can store crafted content can run JavaScript in the browser of users who view it.","category":"package","nicknames":[],"who_cares":["h5p","wordpress","self-hosted","cms"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs scripts in victims' browsers and steals sessions","analyst_note":"Confirm the affected product scope and fixed version from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112867; the description's 'from n/a' leaves the earliest affected version unclear.","how_to_check":"- Check the installed H5P plugin or library version against `1.17.9`\n- Look at the H5P package version in the project's dependency or plugin manifest, if one is used","needs_analyst":true,"not_affected_if":["h5p-not-installed","trusted-authors-only"],"who_is_affected":"Sites and applications that run H5P and let users create or edit H5P content that other users view. Installs that do not use H5P, or where only trusted administrators can author content, are less exposed. The sources do not give further detail on the data path.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000621,"input_tokens":3343,"output_tokens":573,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112867':15A,18A '-2026':14A,17A '1.17.9':12A,32B,90C 'affect':85C 'allow':81C 'attack':48B 'browser':59B 'cms':19B 'content':53B 'craft':52B 'cross':4A,44B,73C 'cross-sit':3A,43B,72C 'cve':13A,16A 'enabl':41B 'fail':33B 'generat':38B,71C 'h5p':1A,20B,26B,78C,79C,80C,86C 'host':24B 'improp':64C 'includ':31B 'input':9A,36B,67C 'issu':84C 'javascript':56B 'n/a':88C 'neutral':35B,65C 'packag':21B 'page':40B,70C 'run':55B 'script':6A,46B,75C 'self':23B 'self-host':22B 'site':5A,45B,74C 'store':2A,42B,51B,82C 'unsanit':8A 'user':61B 'version':27B 'view':63B 'vulner':76C 'web':39B,69C 'wordpress':25B 'xss.this':83C","nicknames":[],"mitigations":[],"who_affected":"Sites and applications that run H5P and let users create or edit H5P content that other users view. Installs that do not use H5P, or where only trusted administrators can author content, are less exposed. The sources do not give further detail on the data path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T07:16:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112867","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112867","severity":null,"published_at":"2026-10-22T07:16:41+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-112867","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112867","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}