Stored Cross-Site Scripting Vulnerability in Webmention Plugin for WordPress

CVE-2026-10513

What is CVE-2026-10513?

The Webmention plugin for WordPress contains a vulnerability that allows Stored Cross-Site Scripting due to inadequate input sanitization and output escaping of user-supplied metadata. This issue arises when the plugin processes MF2 author properties through an unauthenticated webmention REST endpoint. The rendered output can lead to the injection of arbitrary web scripts into comment editing screens, posing a significant risk whenever a privileged user accesses the affected interface. Proper precautions must be taken to mitigate the risk of unauthorized script execution.

References