Webmention Plugin CVE-2026-111109

Requires the Webmention plugin (author pfefferle) installed and active on WordPress at version 5.10.1 or earlier, with webmention receiving enabled. The attacker places the payload in the Open Graph og:title meta tag of a source URL and submits a webmention to a target post. Exploitation is strictly gated on an administrator manually approving the resulting pending webmention comment - per the description the attacker cannot trigger execution on their own (this is the UI:R factor). The script then runs when any user views the injected page. The limiting factors are therefore: mandatory administrator moderation/approval of the pending comment, and the specific affected version range; no authentication is required of the attacker (PR:N) and the submission path is remote and network-reachable.

This is a genuine but moderate-priority issue, not an inflated high-CVSS alarm. The CVSS 3.1 vector (6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) tells a consistent story with the description: a network-reachable, unauthenticated attacker (PR:N) can submit the payload, but exploitation cannot complete without an administrator action (reflected in UI:R) - the description states explicitly that an admin must approve the resulting pending webmention comment before the stored script executes, and the attacker cannot trigger it alone. This human-in-the-loop requirement is the single biggest risk-reducer. No EPSS score was provided in the input, the vulnerability is not listed in CISA KEV, and no proof-of-concept exploit is present, so there is no public exploit identified at time of analysis; these signals point away from widespread opportunistic exploitation. Counterbalancing that, the vendor PR #698 and WordPress trac diff are public and clearly reveal the mechanism (og:title → Item::name stored raw, kses hooks removed in Receiver::process before wp_new_comment), which lowers the research barrier for anyone building an exploit. The vuln.today decision label is 'this_month' (not act_now or emergency), which aligns with the medium severity and absence of active-exploitation signals: patch within a normal monthly cycle rather than as an emergency. Real-world risk is further bounded by the plugin's niche deployment footprint.

An attacker publishes a web page whose Open Graph og:title meta tag contains a script payload (e.g. an img tag with an onerror handler) and sends a webmention pointing that source URL at a target post on the victim WordPress site. The plugin fetches the source, maps og:title to Item::name and stores it unsanitized as a pending comment; when a site administrator later approves that pending webmention comment, the script executes in the browser of anyone viewing the affected page. No public exploit was identified at time of analysis, though the vendor patch diff publicly discloses the exact mechanism.