Interactive Content – H5P

Interactive Content – H5P has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 5 are fixed as of September 2026. Their average CVSS score is 6.5, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 1 high. 2026 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (60%). Other recurring categories include Missing Authorization, Path Traversal.

Every one of the 5 issues recorded for Interactive Content – H5P has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, one record each. Interactive Content – H5P is installed on roughly 40,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium

6.5/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Interactive Content – H5P vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.1CVE-2026-57321

Interactive Content – H5P <= 1.17.7 - Authenticated (Contributor+) Arbitrary File Deletion

Read the full analysis

Vulnerability Records

5 records


2026-06-26 00:00	Interactive Content – H5P <= 1.17.7 - Authenticated (Contributor+) Arbitrary File Deletion Interactive Content <= 1.17.7	`CVE-2026-57321`	8.1 High	daroo	Yes
2026-06-18 00:00	Interactive Content – H5P <= 1.17.6 - Reflected Cross-Site Scripting Interactive Content <= 1.17.6	`CVE-2026-56006`	6.1 Medium	Koutrouss Naddara	Yes
2025-12-28 00:00	H5P <= 1.16.1 - Missing Authorization Interactive Content <= 1.16.1	`CVE-2025-68505`	5.3 Medium	Bao - BlueRock	Yes
2025-10-13 00:00	Interactive Content – H5P <= 1.16.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Interactive Content <= 1.16.0	`CVE-2025-62951`	6.4 Medium	Muhammad Yudha - DJ	Yes
2024-06-06 00:00	H5P <= 1.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting Interactive Content <= 1.15.7	`CVE-2024-3111`	6.4 Medium	Dmitrii Ignatyev	Yes

Showing 1–5 of 5 reports

Latestv1.17.9

Interactive Content – H5P

Author

icc0rz

4.8(61)

96/100

Last Updated

2026-07-30 (2mo ago)

Active Installs

40,000+

Downloads

985,883

Requires WP

3.8.1+

Requires PHP

Tested up to

WP 7.0.4

Created

2014-05-15 (13y ago)

One of the great benefits with using H5P is that it gives you access to lots of different interactive content types, such as presentation, interactive video, memory game, quiz, multiple choice, timeline, collage, hotspots, drag and drop, cloze test (fill in the blanks), personality quiz, accordion, flash cards, audio recorder. Another great benefit with H5P is that it allows you to easily share and reuse content. To use content created with H5P, you simply insert a shortcode [h5p Id="1"] where you wish for the content to appear. To reuse content, you just download the H5P you would like to edit and make your changes – e.g. translate to a new language or adjust it to a new situation. H5P is: Open Source Free to Use HTML5 Responsive The H5P community is actively contributing to improve H5P. Updates and new features are continuously made available on the community portal H5P.org. View our setup for WordPress to get information on how to get started with H5P. GDPR Compliance Information useful to help you achieve GDPR compliance while using this plugin can be found at H5P.org’s GDPR Compliance page.

View on WordPress.org