CVE-2025-62951
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The H5P plugin (icc0rz) contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through <= 1.16.0.
Risk Assessment
An attacker can inject malicious script that executes in the user's browser, potentially leading to session hijacking or data theft. This impacts the security of the WordPress site.
Recommendation
Update the H5P plugin to the latest version that fixes the vulnerability. If an update is not possible, consider disabling the plugin until a patch is released.
Other vulnerabilities in H5P
See all- CVE-2026-56006High
Versions of H5P up to 1.17.6 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
- CVE-2026-57321High
The H5P plugin version 1.17.7 and earlier contains a vulnerability allowing a contributor to delete arbitrary files on the server. The flaw is due to insufficient permission validation during file deletion operations.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icc0rz H5P h5p allows Stored XSS.This issue affects H5P: from n/a through <= 1.16.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS