CVE-2026-111109: Webmention <= 5.10.1 - Unauthenticated Stored Cross-Site Scripting via Open Graph og:title Meta Tag

Q: What must an attacker do to exploit this issue?

An unauthenticated attacker needs to provide a webmention source URL whose Open Graph og:title contains a script payload. The resulting webmention comment must then be approved by an administrator before the payload is stored and can execute.

Q: Who is exposed to the injected script?

Users who access a page containing the approved malicious webmention are exposed to the stored script. The issue can affect any site using an affected Webmention version that accepts and approves the attacker’s webmention.

Q: Are webmentions safe until they are approved?

The described payload is persisted only after an administrator approves the pending webmention comment. Treat pending webmentions from untrusted sources as potentially malicious and do not approve them if their source metadata is suspicious.

Q: What can be done if updating is not immediately possible?

Avoid approving pending webmention comments from untrusted sources, since administrator approval is required for exploitation. Review previously approved webmention comments for suspicious content, especially entries whose content or summary may be empty and whose displayed content could originate from the source og:title metadata.

Published Oct 31, 2026

Updated

The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Graph og:title meta tag of a webmention source URL in versions up to, and including, 5.10.1. This is due to insufficient input sanitization: Meta::addproperties() maps og:title to the Item::name property, but Item has no concrete setname() method, so Item::call() stores the value raw while sibling setcontent()/setsummary() paths route through webmentionsanitizehtml(); Item::getcontent() then falls back to the raw name when content and summary are empty, and Receiver::process() explicitly removes the core wpfilterkses / wpfilterpostkses hooks on precommentcontent before calling wpnewcomment(), so the payload is persisted to commentcontent as-is. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, after an administrator approves the resulting pending webmention comment. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.

Event History

Oct 31, 2026

CVE Published

via MITRE·06:44 AM

Data Sourced

via MITRE·06:44 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker do to exploit this issue?

An unauthenticated attacker needs to provide a webmention source URL whose Open Graph og:title contains a script payload. The resulting webmention comment must then be approved by an administrator before the payload is stored and can execute.

Who is exposed to the injected script?

Users who access a page containing the approved malicious webmention are exposed to the stored script. The issue can affect any site using an affected Webmention version that accepts and approves the attacker’s webmention.

Are webmentions safe until they are approved?

The described payload is persisted only after an administrator approves the pending webmention comment. Treat pending webmentions from untrusted sources as potentially malicious and do not approve them if their source metadata is suspicious.

What can be done if updating is not immediately possible?

Avoid approving pending webmention comments from untrusted sources, since administrator approval is required for exploitation. Review previously approved webmention comments for suspicious content, especially entries whose content or summary may be empty and whose displayed content could originate from the source og:title metadata.

CVE-2026-111109: Webmention <= 5.10.1 - Unauthenticated Stored Cross-Site Scripting via Open Graph og:title Meta Tag

Event History

Frequently Asked Questions

What must an attacker do to exploit this issue?

Who is exposed to the injected script?

Are webmentions safe until they are approved?

What can be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to exploit this issue?

Who is exposed to the injected script?

Are webmentions safe until they are approved?

What can be done if updating is not immediately possible?