Live › vulnerability › CVE-2026-111109
The Webmention plugin for WordPress up to and including 5.10.1 stores the Open Graph og:title value from a webmention source URL without sanitizing it, and removes WordPress's usual comment filters before saving. An unauthenticated attacker can get a script saved into a comment that runs in the browser of anyone who views the page after an administrator approves it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 07:34 UTC. All times on this page are UTC.
Sites running the Webmention plugin version 5.10.1 or earlier that accept incoming webmentions and let administrators moderate them. The risk depends on an administrator approving the pending comment, so sites with webmention disabled or no moderation exposure face less risk. Sites on other comment systems are not affected.
No product ranges from the sources yet.
wp plugin get webmention --field=version5.10.1 (the fixed version is not stated in the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Graph og:title meta tag of a webmention source URL in versions up to, and including, 5.10.1. This is due to insufficient input sanitization: Meta::add_properties() maps og:title to the Item::name property, but Item has no concrete set_name() method, so Item::__call() stores the value raw while sibling set_content()/set_summary() paths route through webmention_sanitize_html(); Item::get_content() then falls back to the raw name when content and summary are empty, and Receiver::process() explicitly removes the core wp_filter_kses / wp_filter_post_kses hooks on pre_comment_content before calling wp_new_comment(), so the payload is persisted to comment_content as-is. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, after an administrator approves the resulting pending webmention comment. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.
This page as .md · .json · in your agent: get_signal("CVE-2026-111109")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.