PLUGIN SECURITY
Is H5p safe?
Create and add rich content to your website for free. Some examples of what you get with H5P are Interactive Video, Quizzes, Collage and Timeline.
What this plugin does
- Slug:
h5p - Author: icc0rz
- 40000+ active installs
- 96/100 rating (61 reviews on wordpress.org)
- 984582 all-time downloads
- On WordPress.org since 2014-05-15
editoreducationquizslidervideo
Maintenance status
- Latest known version: 1.17.9
- Last updated: 2026-07-30 12:22pm GMT
- Tested up to WordPress: 7.0.4
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
5 known CVEs on file for H5p. Reported between 2024 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-57321 | Interactive Content – H5P [h5p] < 1.17.8 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | High 7.1 | < 1.17.8 | 1.17.8 | 2026-06-26 | ✓ fixed in latest |
| CVE-2026-56006 | Interactive Content – H5P [h5p] < 1.17.7 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 1.17.7 | 1.17.7 | 2026-06-18 | ✓ fixed in latest |
| CVE-2025-68505 | Interactive Content – H5P [h5p] < 1.16.2 | Missing Authorization | Medium 5.3 | < 1.16.2 | 1.16.2 | 2025-12-24 | ✓ fixed in latest |
| CVE-2025-62951 | Interactive Content – H5P [h5p] < 1.16.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 1.16.1 | 1.16.1 | 2025-10-13 | ✓ fixed in latest |
| CVE-2024-3111 | Interactive Content – H5P [h5p] < 1.15.8 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 1.15.8 | 1.15.8 | 2024-06-06 | ✓ fixed in latest |
How to fix it
Keep H5p updated — 1.17.9 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Elementor Website Builder – more than just a page builder — 10000000+ active installs — 90/100 (7297)
- Classic Editor — 8000000+ active installs — 98/100 (1246) — max PHP 8.4
- Classic Widgets — 2000000+ active installs — 98/100 (272) — max PHP 8.4
- Advanced Editor Tools — 1000000+ active installs — 90/100 (354) — max PHP 8.4
- Spectra Legacy – Gutenberg Blocks — 1000000+ active installs — 94/100 (1870) — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.