Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in H5P H5P h5p allows Stored XSS.This issue… (CVE-2026-112867)

CVE-2026-112867 describes a stored cross-site scripting (XSS) vulnerability in H5P versions up to and including 1.17.9. The issue arises from improper neutralization of input during web page generation, allowing an attacker with low privileges and requiring user interaction to inject and execute malicious scripts. The vulnerability impacts confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker with low privileges to execute arbitrary scripts in the context of other users, potentially leading to limited disclosure of information, modification of data, and partial disruption of service. The scope is changed (S:C), meaning the vulnerability can affect resources beyond the vulnerable component's privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit exposure by restricting user privileges and exercising caution with user-generated content. Monitor official H5P channels for updates.