What is the CVSS score of CVE-2026-10513?

CVE-2026-10513 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Webmention (WordPress) are affected by CVE-2026-10513?

The Webmention WordPress plugin (versions 5.8.0 and earlier) contains a stored cross-site scripting vulnerability allowing unauthenticated attackers to inject malicious code that executes when…

How to fix or mitigate CVE-2026-10513?

Within 24 hours: Disable the Webmention plugin (wp plugin deactivate webmention) and audit wp_comments for suspicious 'mf2' entries containing script tags. Within 7 days: Monitor the official Webmention plugin repository for security patches; plan immediate upgrade if patch is released. Within 30 days: Implement a plugin security scanning process and evaluate alternative webmention solutions.

Webmention (WordPress) CVE-2026-10513

EUVD-2026-40376 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-30 Wordfence

GHSA-q4c4-6mqr-j8hq

WordPress XSS Webmention Wordpress Plugin Pfefferle

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Unauthenticated injection via the network endpoint (PR:N, AV:N, AC:L), but execution needs a moderator to open the edit screen (UI:R), with scope change into the admin browser context (S:C) and limited C/I impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 19:22 vuln.today

CVE Published

Jun 30, 2026 - 18:32 nvd

HIGH 7.2

DescriptionCVE.org

The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.8.0 via parser-derived 'avatar' and 'url' author metadata. This is due to insufficient input sanitization and output escaping on user-supplied MF2 author properties processed by the unauthenticated webmention REST endpoint and rendered directly into HTML 'value' attributes by the edit-comment-form template without esc_attr() or esc_url(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a privileged user (moderator or administrator) opens the affected comment edit screen.

Articles & Coverage 1

News 7 New WordPress Vulnerabilities - 2 Critical, 5 High, 2 With POC Jul 01, 2026

AnalysisAI

Stored cross-site scripting in the Webmention WordPress plugin (versions up to and including 5.8.0) lets unauthenticated attackers persist malicious script through the public webmention REST endpoint, which a moderator or administrator then triggers simply by opening the affected comment's edit screen. Attacker-controlled MF2 'avatar' and 'url' author properties are stored and later echoed unescaped into HTML 'value' attributes, yielding script execution in a privileged admin session. No public exploit identified at time of analysis, and no EPSS or CISA KEV signal is present in the provided data.

Technical ContextAI

Webmention is a WordPress plugin (vendor 'pfefferle', cpe:2.3:a:pfefferle:webmention) implementing the W3C Webmention protocol, where one site notifies another that it has linked to it; the receiving site parses the source page for Microformats2 (MF2) author metadata such as name, avatar, and url. The root cause is CWE-79 (improper neutralization of input during web page generation): the MF2 handler (includes/handler/class-mf2.php) extracts author 'avatar' and 'url' values from the remote, attacker-controlled source page and stores them as comment metadata, and the edit-comment-form.php template renders those values directly into HTML 'value' attributes without esc_attr() or esc_url(). Because the parsing is reachable through the unauthenticated webmention REST endpoint, an attacker fully controls the stored payload, and the lack of context-appropriate output escaping allows attribute-breakout XSS when the data is reflected into the moderation UI.

RemediationAI

Upgrade the Webmention plugin to the latest version that includes the fix from WordPress plugin changeset 3583033 (https://plugins.trac.wordpress.org/changeset/3583033/webmention), which adds proper output escaping; the changeset confirms an upstream fix is available, but a specific released patched version number is not stated in the provided data, so confirm the fixed version on the plugin page before deploying. As interim compensating controls if you cannot update immediately: disable inbound Webmention receiving (deactivate the plugin or block/deny POST requests to the webmention REST endpoint at the web server or WAF), which stops new malicious author metadata from being stored but also disables the plugin's core inbound functionality; and review/purge existing pending webmention-derived comments before opening them in the editor, since the payload fires on the edit screen. Train moderators to avoid opening suspicious pending webmention comments until patched. Reference the Wordfence advisory above for detection guidance.