Atomic Edge analysis of CVE-2026-56006:
This vulnerability is a Reflected Cross-Site Scripting (XSS) flaw in the Interactive Content – H5P plugin for WordPress, version 1.17.6 and earlier. It resides in the library admin functionality, specifically in the upgrade status message. The issue allows unauthenticated attackers to inject arbitrary web scripts via a crafted return URL parameter, which executes when a victim clicks a link. The CVSS score is 6.1 (Medium), with CWE-79 (Cross-Site Scripting).
The root cause is insufficient input sanitization and output escaping in the file `/h5p/admin/class-h5p-library-admin.php`, around line 448. The vulnerable code constructs a ‘done’ message string by appending an anchor tag (``) whose `href` attribute is directly derived from the `$return` variable. The `$return` variable comes from an HTTP request parameter (likely `_wp_http_referer` or a similar redirect-referrer) without validation. No check ensures the URL is a legitimate, safe internal URL before inserting it into the HTML output. The WordPress functions `sprintf` and translation are used for the message text, but the `$return` value is concatenated unsanitized, enabling an attacker to inject a full malicious URL (e.g., `javascript:alert(1)` or a link to an attacker-controlled domain with XSS payloads).
Exploitation requires tricking an authenticated administrator with H5P library upgrade privileges into clicking a crafted link. The attacker can craft a URL pointing to the H5P library admin page, such as `/wp-admin/admin.php?page=h5p_libraries&upgrade=1&token=…&return=javascript:alert(document.cookie)`. When the user triggers the upgrade action and the vulnerable code generates the success message (e.g., on the library management page), the browser renders the malicious `href` attribute. A victim clicking the ‘Return’ link executes the injected JavaScript in the context of the WordPress admin panel, potentially stealing session cookies, performing actions on behalf of the admin, or redirecting to phishing pages. The `$return` parameter is typically the `_wp_http_referer` but can be manipulated in the URL because the plugin does not enforce a nonce or URL whitelist on it.
The patch, visible in the diff, adds two security measures: (1) a call to `wp_http_validate_url($return)` to ensure the URL is a valid, safe HTTP or HTTPS URL, and (2) `sanitize_url($return)` to strip dangerous characters and protocols like `javascript:`. The patched code now only outputs the anchor tag if both conditions pass, and it sanitizes the URL before rendering. In the vulnerable version, the `$return` value was directly concatenated without checks. The patch also updates the plugin version from 1.17.6 to 1.17.7. This change eliminates the ability to inject arbitrary URLs and effectively neutralizes reflected XSS via this vector.
If exploited, the impact includes unauthorized data access (e.g., session tokens, cookies), privilege escalation (if an admin’s session is hijacked), or further compromise of the WordPress site (e.g., installing malicious plugins or defacing content). Since the attacker requires an authenticated admin to click the link, the risk is lower than unauthenticated stored XSS, but it still poses a significant phishing and social engineering threat.
