{"id":"CVE-2026-111109","kind":"vulnerability","aliases":["CVE-2026-111109"],"related":[],"title":"WordPress Webmention plugin: unsanitized og:title enables stored cross-site scripting","description":"The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Graph og:title meta tag of a webmention source URL in versions up to, and including, 5.10.1. This is due to insufficient input sanitization: Meta::add_properties() maps og:title to the Item::name property, but Item has no concrete set_name() method, so Item::__call() stores the value raw while sibling set_content()/set_summary() paths route through webmention_sanitize_html(); Item::get_content() then falls back to the raw name when content and summary are empty, and Receiver::process() explicitly removes the core wp_filter_kses / wp_filter_post_kses hooks on pre_comment_content before calling wp_new_comment(), so the payload is persisted to comment_content as-is. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, after an administrator approves the resulting pending webmention comment. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.","summary":"The Webmention plugin for WordPress up to and including 5.10.1 stores the Open Graph og:title value from a webmention source URL without sanitizing it, and removes WordPress's usual comment filters before saving. An unauthenticated attacker can get a script saved into a comment that runs in the browser of anyone who views the page after an administrator approves it.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","webmention","wordpress"],"not_affected_if":["newer-version-installed","webmention-plugin-absent"],"how_to_check":"- Check the installed Webmention plugin version in the WordPress admin plugin list or with `wp plugin get webmention --field=version`\n- Look for pending webmention comments that contain script tags or unusual og:title text under the comment moderation queue","fix":"- Webmention plugin: upgrade to a version later than `5.10.1` (the fixed version is not stated in the sources)","status":"open","published_at":"2026-10-31T07:16:34+00:00","first_seen_at":"2026-10-31T07:34:07+00:00","triaged_at":"2026-10-31T07:34:43+00:00","updated_at":"2026-10-31T07:34:43+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-31T07:34:43Z","model":"claude-haiku-5-5","output":{"fix":"- Webmention plugin: upgrade to a version later than `5.10.1` (the fixed version is not stated in the sources)","reach":"internet","title":"WordPress Webmention plugin: unsanitized og:title enables stored cross-site scripting","impact":"medium","summary":"The Webmention plugin for WordPress up to and including 5.10.1 stores the Open Graph og:title value from a webmention source URL without sanitizing it, and removes WordPress's usual comment filters before saving. An unauthenticated attacker can get a script saved into a comment that runs in the browser of anyone who views the page after an administrator approves it.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","webmention","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Scripts run in visitors' and administrators' browsers on the site","analyst_note":"","how_to_check":"- Check the installed Webmention plugin version in the WordPress admin plugin list or with `wp plugin get webmention --field=version`\n- Look for pending webmention comments that contain script tags or unusual og:title text under the comment moderation queue\n- unknown for other indicators","plain_action":"","needs_analyst":false,"not_affected_if":["webmention-plugin-absent","newer-version-installed"],"who_is_affected":"Sites running the Webmention plugin version 5.10.1 or earlier that accept incoming webmentions and let administrators moderate them. The risk depends on an administrator approving the pending comment, so sites with webmention disabled or no moderation exposure face less risk. Sites on other comment systems are not affected.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000746,"input_tokens":4405,"output_tokens":612,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111109':15A,18A '-2026':14A,17A '/set_summary':155C '5.10.1':34B,117C 'access':233C 'action':251C 'add':126C 'addit':248C 'administr':83B,239C,254C 'anyon':76B 'approv':84B,240C 'arbitrari':222C 'as-i':210C 'attack':61B,219C,256C 'back':167C 'browser':74B 'call':146C,198C 'cannot':257C 'comment':55B,69B,195C,201C,208C,245C 'concret':140C 'content':154C,164C,173C,196C,209C 'core':184C 'cross':10A,95C 'cross-sit':9A,94C 'cve':13A,16A 'due':120C 'empti':177C 'enabl':7A 'execut':229C 'explicit':181C 'exploit':247C 'fall':166C 'filter':56B,186C,189C 'get':63B,163C 'graph':38B,101C 'hook':192C 'host':22B 'html':161C 'includ':33B,116C 'inject':221C,235C 'input':123C 'insuffici':122C 'item':133C,137C,145C,162C 'kses':187C,191C 'make':214C 'map':128C 'meta':104C,125C 'method':143C 'name':134C,142C,171C 'new':200C 'og':5A,39B,102C,129C 'open':37B,100C 'packag':19B 'page':80B,226C,236C 'path':156C 'payload':204C 'pend':243C 'persist':206C 'plugin':3A,27B,87C 'possibl':216C 'post':190C 'pre':194C 'process':180C 'properti':127C,135C 'raw':150C,170C 'receiv':179C 'remov':51B,182C 'requir':249C 'result':242C 'rout':157C 'run':71B 'sanit':48B,124C,160C 'save':58B,66B 'script':12A,65B,97C,224C 'self':21B 'self-host':20B 'set':141C,153C 'sibl':152C 'site':11A,96C 'sourc':45B,109C 'store':8A,35B,93C,147C 'success':246C 'summari':175C 'tag':105C 'titl':6A,40B,103C,130C 'trigger':258C 'unauthent':60B,218C 'unsanit':4A 'url':46B,110C 'user':232C 'usual':54B 'valu':41B,149C 'version':112C 'via':98C 'view':78B 'vulner':91C,260C 'web':223C 'webment':2A,23B,26B,44B,86C,108C,159C,244C 'whenev':230C 'without':47B 'wordpress':1A,24B,29B,52B,89C 'wp':185C,188C,199C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Webmention plugin version 5.10.1 or earlier that accept incoming webmentions and let administrators moderate them. The risk depends on an administrator approving the pending comment, so sites with webmention disabled or no moderation exposure face less risk. Sites on other comment systems are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T07:16:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111109","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111109","severity":null,"published_at":"2026-10-31T07:16:34+00:00","modified_at":"2026-10-31T07:16:34+00:00","first_seen_at":"2026-10-31T07:34:07+00:00","fetched_at":"2026-10-31T07:34:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}