Medium severityNVD Advisory· Published Sep 9, 2026

CVE-2025-7062

Description

A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module h5p-nodejs-library by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Lumieducation/H5p Nodejs Libraryreferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=10.0.4

Patches

Vulnerability mechanics

References

github.com/Lumieducation/H5P-Nodejs-library/releases/tag/v10.0.4nvd
www.schutzwerk.com/en/blog/schutzwerk-sa-2024-007/nvd

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000