plugin
8 known security issues reported for the H5P WordPress plugin. Most recent disclosed Jun 26, 2026.
Running H5P on your site? Check whether your installed version is affected.
Scan your site freeThe Interactive Content – H5P plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and including, 1.17.7. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, which c...
The Interactive Content – H5P plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.17.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can s...
The Interactive Content – H5P plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.16.1. This makes it possible for unauthenticated attackers to perform an unauthorized action.
[en] Missing Authorization vulnerability in icc0rz H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through <= 1.16.1.
[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icc0rz Interactive Content – H5P h5p allows Stored XSS.This issue affects Interactive Content – H5P: from n/a through <= 1.16.0.
The Interactive Content – H5P plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.16.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web script...
[en] The Interactive Content WordPress plugin before 1.15.8 does not validate uploads which could allow a Contributors and above to update malicious SVG files, leading to Stored Cross-Site Scripting issues
The Interactive Content – H5P plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.15.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to in...
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free