Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
16 results
Oct 22, 2026H5P: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-112867 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in H5P H5P h5p allows Stored XSS.This issue affects H5P: from n/a through 1.17.9.
- Product
- H5P
- Affected
- up to 1.17.9
- What to do
- Affects up to 1.17.9. Update H5P to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026H5P: Authorization Bypass Through User-Controlled KeyCVE-2026-112868 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through 1.17.9.
- Product
- H5P
- Affected
- up to 1.17.9
- What to do
- Affects up to 1.17.9. Update H5P to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2026A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and includinCVE-2025-7062 · Other software · Lumi Education UG · reported by 23637b5d-af4c-4cf9-b8f6-deb7fd0f8423Medium 5.2
A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content.
- Product
- h5p-nodejs-library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comschutzwerk.com
Aug 5, 2026NULL pointer dereference in H5Pget_fill_value in HDF5 before 2.3.0 allows attackers to cause a denial of service via a dataset whose version 1 or 2 fill value mCVE-2026-19024 · Other software · The HDF Group · reported by 0253b833-3e77-4dfe-9d57-17db1a2f0a74High 8.2
NULL pointer dereference in H5Pget_fill_value in HDF5 before 2.3.0 allows attackers to cause a denial of service via a dataset whose version 1 or 2 fill value message has the "defined" flag set together with a negative size field, which is not normalized to the library's "undefined" sentinel and reaches H5T_path_find with a NULL datatype.
- Product
- HDF5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions.CVE-2026-57321 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions.
- What to do
- Update the plugin to the newest version.
Jun 25, 2026Unauthenticated Cross Site Scripting (XSS) in H5P <= 1.17.6 versions.CVE-2026-56006 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in H5P <= 1.17.6 versions.
- Affected
- up to 1.17.6
- What to do
- Affects up to 1.17.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025H5P: Missing AuthorizationCVE-2025-68505 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in icc0rz H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through <= 1.16.1.
- Product
- H5P
- Affected
- up to 1.16.1
- What to do
- Affects up to 1.16.1. Update H5P to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 13, 2025SNORDIAN's H5PxAPIkatchu: Stored Cross-Site ScriptingCVE-2025-12904 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The SNORDIAN's H5PxAPIkatchu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'insert_data' AJAX endpoint in all versions up to, and including, 0.4.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- SNORDIAN's H5PxAPIkatchu
- Affected
- up to 0.4.17
- What to do
- Affects up to 0.4.17. Update SNORDIAN's H5PxAPIkatchu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 26, 2025H5P: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62951 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icc0rz H5P h5p allows Stored XSS.This issue affects H5P: from n/a through <= 1.16.0.
- Product
- H5P
- Affected
- up to 1.16.0
- What to do
- Affects up to 1.16.0. Update H5P to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 10, 2025Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings.CVE-2025-47828 · Other software · Lumi · reported by MITREMedium 6.4
Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings.
- Product
- H5P-Nodejs-library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025SNORDIAN's H5PxAPIkatchu: Missing AuthorizationCVE-2025-30821 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in otacke SNORDIAN's H5PxAPIkatchu h5pxapikatchu allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects SNORDIAN's H5PxAPIkatchu: from n/a through <= 0.4.14.
- Product
- SNORDIAN's H5PxAPIkatchu
- Affected
- up to 0.4.14
- What to do
- Affects up to 0.4.14. Update SNORDIAN's H5PxAPIkatchu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2024Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups.CVE-2024-25980 · Other software · moodle · reported by patrick@puiterwijk.orgMedium 4.3
Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers.
- Product
- h5p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Nov 9, 2023H5P metadata automatically populated the author with the user's username, which could be sensitive information.CVE-2023-5545 · Other software · moodle · reported by patrick@puiterwijk.orgLow 3.3
H5P metadata automatically populated the author with the user's username, which could be sensitive information.
- Product
- h5p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Oct 6, 2022Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk.CVE-2022-2986 · Other software · Moodle · reported by patrick@puiterwijk.orgHigh 8.8
Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Sep 30, 2022The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users iCVE-2022-40316 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 4.3
The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users in groups they should not have access to.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.commoodle.org
Dec 14, 2021H5P CSS Editor: Reflected Cross-Site ScriptingCVE-2021-39318 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The H5P CSS Editor WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the h5p-css-file parameter found in the ~/h5p-css-editor.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
- Product
- H5P CSS Editor
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update H5P CSS Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.