CVE-2026-10513

Name of the Vulnerable Software and Affected Versions Webmention versions prior to 5.8.1

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping of user-supplied Microformat 2 (MF2) author properties. An unauthenticated attacker can inject arbitrary web scripts via the avatar and url author metadata processed by the unauthenticated webmention REST endpoint. These scripts are rendered directly into HTML value attributes by the edit-comment-form template without the use of esc attr() or esc url() functions. The injected scripts execute when a privileged user, such as a moderator or administrator, opens the affected comment edit screen.

Recommendations Update Webmention to a version later than 5.8.0.