The H5P WordPress plugin fails to neutralize certain user input during web page generation, allowing malicious JavaScript to be stored by the plugin. The stored script is then rendered when other visitors load pages that include the affected content, executing in the context of those users’ browsers. The result is a stored cross‑site scripting flaw that can be used to execute arbitrary code on the visitor’s machine, potentially exposing the user to data theft, session hijacking, or other browser‑level attacks.

All WordPress sites that use the H5P plugin version 1.17.9 or earlier are affected. Versions from the initial release through 1.17.9 are vulnerable, as the issue is present in all iterations prior to the 1.17.10 release.

The CVSS score of 6.5 indicates a moderate severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires access to a content input field that the H5P plugin stores and later renders. An attacker can inject malicious payloads via those input mechanisms, leading to the execution of arbitrary code in the context of any visitor who views the affected page. Because the flaw is widespread across all earlier releases, administrators should consider the risk significant and act promptly to mitigate.