Stored Cross-Site Scripting Vulnerability in Webmention Plugin for WordPress

CVE-2026-111109

What is CVE-2026-111109?

The Webmention plugin for WordPress contains a vulnerability that allows for stored Cross-Site Scripting through the Open Graph og:title meta tag of a webmention source URL in versions up to and including 5.10.1. Insufficient input sanitization in the plugin leads to the raw storage of potentially malicious scripts. When a webmention comment is approved by an administrator, these scripts can execute whenever a user visits the affected page, enabling unauthenticated attackers to inject arbitrary web scripts. This vulnerability highlights the necessity for robust input validation to prevent such security flaws.

References