Medium severity · published Sep 9, 2026
CVE-2025-7062
Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education
5.2
CVSS
0.5%
EPSS
No
On KEV
Description
A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
H5
h5p-nodejs-library · Lumi Education UG
before 10.0.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-7062
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-7062
github.com
https://github.com/Lumieducation/H5P-Nodejs-library/releases/tag/v10.0.4
www.schutzwerk.com
https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-007/
seclists.org
http://seclists.org/fulldisclosure/2026/Sep/41