CVE-2026-111109
Received Received - Intake

Stored XSS in WordPress Webmention Plugin via og:title

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: Wordfence

Description
The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Graph og:title meta tag of a webmention source URL in versions up to, and including, 5.10.1. This is due to insufficient input sanitization: Meta::add_properties() maps og:title to the Item::name property, but Item has no concrete set_name() method, so Item::__call() stores the value raw while sibling set_content()/set_summary() paths route through webmention_sanitize_html(); Item::get_content() then falls back to the raw name when content and summary are empty, and Receiver::process() explicitly removes the core wp_filter_kses / wp_filter_post_kses hooks on pre_comment_content before calling wp_new_comment(), so the payload is persisted to comment_content as-is. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, after an administrator approves the resulting pending webmention comment. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-111109
EUVD
EUVD-2026-114592

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pfefferle Webmention 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Webmention plugin for WordPress has a stored Cross-Site Scripting (XSS) vulnerability in versions up to 5.10.1. It occurs because the plugin fails to sanitize the og:title meta tag from a webmention source URL. The unsanitized value is stored raw and later used in comment content without proper filtering, allowing attackers to inject malicious scripts.

Detection Guidance

Check for pending webmention comments in WordPress admin panel under Comments section. Look for suspicious og:title values in source URLs that contain HTML or script tags. Review plugin version in WordPress admin under Plugins to confirm if version is 5.10.1 or below.

Impact Analysis

An unauthenticated attacker could inject malicious scripts into web pages. When an administrator approves the webmention comment, the script executes for any user accessing the infected page. This could lead to theft of session cookies, account takeover, or defacement of the website.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements. If exploited, it may result in data breaches, triggering compliance violations and potential legal penalties.

Mitigation Strategies

Update the Webmention plugin to version 5.10.2 or higher immediately. Temporarily disable the plugin if update is not possible. Review and delete any suspicious pending webmention comments. Monitor comments for unusual HTML/script content.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111109. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart