CVE-2026-56006

Versions of H5P up to 1.17.6 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.

Organizations may be exposed to user data theft and other attacks that could lead to a loss of trust in the application.

It is recommended to update H5P to the latest version to mitigate this vulnerability and conduct a security audit of the application.