WordPress plugin
Interactive Content – H5P security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 7 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High1
- Medium6
- Low0
All Interactive Content – H5P vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤1.17.9Update to 1.17.10 | CVE-2026-112867 | |
| Medium4.3 | Authenticated (Contributor+) Insecure Direct Object Reference ≤1.17.9Update to 1.17.10 | CVE-2026-112868 | |
| High8.1 | Authenticated (Contributor+) Arbitrary File Deletion ≤1.17.7Update to 1.17.8 | CVE-2026-57321 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤1.17.6Update to 1.17.7 | CVE-2026-56006 | |
| Medium5.3 | Missing Authorization ≤1.16.1Update to 1.16.2 | CVE-2025-68505 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤1.16.0Update to 1.16.1 | CVE-2025-62951 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤1.15.7Update to 1.15.8 | CVE-2024-3111 |
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.17.9Update to 1.17.10
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
≤1.17.9Update to 1.17.10
- High8.1Authenticated (Contributor+) Arbitrary File Deletion
≤1.17.7Update to 1.17.8
- Medium6.1Reflected Cross-Site Scripting
≤1.17.6Update to 1.17.7
- Medium5.3Missing Authorization
≤1.16.1Update to 1.16.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.16.0Update to 1.16.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.15.7Update to 1.15.8
Interactive Content – H5P: common questions
Does Interactive Content – H5P have known vulnerabilities?
Yes. VulnCrest Radar lists 7 known vulnerabilities in Interactive Content – H5P: 1 high, 6 medium. None are known to affect version null.
How do I check which version of Interactive Content – H5P I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Interactive Content – H5P vulnerability?
CVE-2026-112867, published Oct 22, 2026: Interactive Content – H5P <= 1.17.9 - Authenticated (Contributor+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).
Is any Interactive Content – H5P vulnerability listed in CISA KEV?
No. None of the known Interactive Content – H5P vulnerabilities is currently listed in the CISA KEV catalog.