CVE-2026-111109

Name of the Vulnerable Software and Affected Versions Webmention plugin for WordPress versions prior to 5.10.2

Description Stored Cross-Site Scripting occurs via the Open Graph og:title meta tag of a webmention source URL. The issue stems from insufficient input sanitization where Meta::add properties() maps og:title to the Item::name property. Because Item lacks a concrete set name() method, Item:: call() stores the value raw, unlike set content() or set summary() which use webmention sanitize html(). When content and summary are empty, Item::get content() uses the raw name. Furthermore, Receiver::process() removes the wp filter kses and wp filter post kses hooks on pre comment content before calling wp new comment(), allowing the payload to be saved to comment content. Unauthenticated attackers can inject arbitrary web scripts that execute when a user views the page, provided an administrator approves the pending webmention comment.

Recommendations Update the Webmention plugin for WordPress to version 5.10.2 or later.