Unauthenticated Cross Site Scripting Vulnerability in H5P Plugin by WordPress
CVE-2026-56006

7.1HIGH

Key Information:

Vendor

WordPress
Status
H5p
Vendor
CVE Published:
25 June 2026

What is CVE-2026-56006?

The H5P Plugin for WordPress is impacted by an unauthenticated Cross Site Scripting (XSS) vulnerability that affects versions up to 1.17.6. This issue may allow attackers to exploit the vulnerability without authentication, potentially leading to malicious scripts being executed in the context of a victim's browser session. It is crucial for users to address this vulnerability in order to safeguard their WordPress installations and user data.

Affected Version(s)

H5P <= 1.17.6

References

https://patchstack.com/database/wordpress/plugin/h5p/vuln...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Koutrouss Naddara | Patchstack Bug Bounty Program
.