Description
The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Graph og:title meta tag of a webmention source URL in versions up to, and including, 5.10.1. This is due to insufficient input sanitization: Meta::add_properties() maps og:title to the Item::name property, but Item has no concrete set_name() method, so Item::__call() stores the value raw while sibling set_content()/set_summary() paths route through webmention_sanitize_html(); Item::get_content() then falls back to the raw name when content and summary are empty, and Receiver::process() explicitly removes the core wp_filter_kses / wp_filter_post_kses hooks on pre_comment_content before calling wp_new_comment(), so the payload is persisted to comment_content as-is. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, after an administrator approves the resulting pending webmention comment. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.
Published: 2026-10-31
Score: 6.1 Medium
EPSS: n/a
KEV: No
Impact: Stored Cross‑Site Scripting that requires an administrator to approve a comment before the malicious payload is executed in the context of the site
Action: Patch Immediately
AI Analysis

Impact

The Webmention plugin for WordPress allows unauthenticated users to inject arbitrary scripts via the Open Graph og:title meta tag of a target URL. Insufficient sanitization causes the value of og:title to be stored raw as item name, which is later rendered as comment content when a comment is approved. The skipped WordPress sanitization hooks allow the payload to persist unchanged and execute in the victim's browser. This constitutes a stored cross‑site scripting vulnerability (CWE‑79).

Affected Systems

WordPress sites that have the Webmention plugin version 5.10.1 or older installed are affected. The vulnerability resides in pfefferle:Webmention plugin code, specifically the class-receiver.php, item classes, and meta handling. Updating to any release after 5.10.1 removes the flaw.

Risk and Exploitability

The CVSS score is 6.1, indicating a medium severity attack. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to send a crafted webmention that contains malicious javascript in the og:title field; the attacker cannot complete the exploitation alone. The adversary must then rely on an administrator to approve the pending webmention, at which point the script will run for any user who views the affected page.

Generated by OpenCVE AI on October 31, 2026 at 08:29 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Webmention plugin to version 5.10.2 or later, which removes the vulnerability.
  • If an update is not immediately possible, configure the site to reject or manually review pending Webmention comments before approval, and delete any that contain suspicious og:title content.
  • Consider re‑enabling or enforcing WordPress’s wp_filter_kses sanitation for comment content to prevent raw HTML from persisting in stored comments.

Generated by OpenCVE AI on October 31, 2026 at 08:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 31 Oct 2026 07:00:00 +0000

Type Values Removed Values Added
Description The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Graph og:title meta tag of a webmention source URL in versions up to, and including, 5.10.1. This is due to insufficient input sanitization: Meta::add_properties() maps og:title to the Item::name property, but Item has no concrete set_name() method, so Item::__call() stores the value raw while sibling set_content()/set_summary() paths route through webmention_sanitize_html(); Item::get_content() then falls back to the raw name when content and summary are empty, and Receiver::process() explicitly removes the core wp_filter_kses / wp_filter_post_kses hooks on pre_comment_content before calling wp_new_comment(), so the payload is persisted to comment_content as-is. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, after an administrator approves the resulting pending webmention comment. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.
Title Webmention <= 5.10.1 - Unauthenticated Stored Cross-Site Scripting via Open Graph og:title Meta Tag
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-10-31T06:44:14.112Z

Reserved: 2026-10-15T15:58:12.238Z

Link: CVE-2026-111109

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-31T07:16:34.827

Modified: 2026-10-31T07:16:34.827

Link: CVE-2026-111109

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-31T08:30:13Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')