Webmention (WordPress) EUVD-2026-40376

Exploitation requires the target site to have the Webmention plugin (≤5.8.0) installed with inbound webmention receiving enabled, since the injection vector is the unauthenticated webmention REST endpoint processing MF2 'avatar' and 'url' author properties from an attacker-controlled source page. The decisive limiting factor is the trigger: the stored payload only executes when a privileged user (moderator or administrator) opens the affected comment's edit screen in wp-admin - it does not fire on the public site or merely on storage, so a moderator who never opens the malicious comment is not impacted. No authentication is needed to plant the payload (PR:N), but the human moderation step is a real constraint that lowers practical likelihood relative to fully automatable XSS.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) reflects network reachability, low complexity, no privileges, and a scope change into the admin browser context. However, UI:N is debatable: execution requires a privileged user to open the affected comment's edit screen, which is passive user interaction - a realistic but non-default-guaranteed trigger that meaningfully limits exploitation, so the practical risk is somewhat lower than the 7.2 implies. No EPSS score, KEV listing, or POC was supplied, meaning there is no evidence of active exploitation or automatable mass exploitation; treat this as a credible but not emergency-tier issue. The most important conflicting signal to flag: the stored-XSS-on-admin-view design pattern is reliably reachable by unauthenticated actors, but actual impact (C:L/I:L) is confined to what the admin's session can do until chained - verify the UI requirement against the vendor advisory before deprioritizing.

An attacker hosts a web page containing MF2 author markup whose 'avatar' or 'url' property carries an attribute-breakout XSS payload, then sends an unauthenticated webmention to a target WordPress post linking to that page. The plugin parses and stores the malicious metadata as a pending comment; when a moderator or administrator later opens that comment's edit screen, the script executes in their authenticated session, enabling actions such as creating a rogue admin or altering content. No POC is referenced, but the network attack vector and low complexity make reliable exploitation straightforward.