CVE-2026-10513: Webmention Plugin WordPress Stored XSS Vulnerability

Technical summary

CVE-2026-10513 is a stored XSS vulnerability in the Webmention plugin for WordPress versions up to 5.8.0. The vulnerability originates in the unauthenticated webmention REST endpoint, which accepts MF2 (Microformats2) author properties without sufficient input sanitization. These properties are later rendered into HTML 'value' attributes within the edit-comment-form template without applying proper output encoding functions (esc_attr() or esc_url()). An attacker can craft a malicious webmention with XSS payloads in the avatar or url metadata fields. The payload is stored in the database and executed in the context of a privileged user's session when they access the WordPress comment editing interface.

Business impact

This vulnerability creates a pathway for attackers to compromise WordPress site administrators and moderators without requiring authentication. A successful attack could lead to unauthorized changes to site content, installation of backdoors, theft of authentication tokens, or modification of plugin/theme code. Since the attack vector is unauthenticated and the payload is stored, it can affect all site administrators who perform comment moderation duties. For multi-author or community-driven WordPress installations that use webmentions, the risk is amplified.

Affected systems

The Webmention plugin for WordPress is affected in versions up to and including 5.8.0. WordPress sites that have this plugin installed and enabled are at risk, particularly those that accept webmentions from external sources and have users with administrative or moderator permissions who review comments. The vulnerability requires no authentication to trigger, making all publicly accessible WordPress installations with this plugin vulnerable to initial payload injection.

Exploitability

Exploitability is high. The vulnerability requires no authentication, no complex user interaction beyond standard administrative tasks (viewing comments), and the attack surface is wide—any external webmention can deliver the payload. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) reflects network accessibility and low complexity. However, the attack does require a privileged user to view the comment edit screen for the stored payload to execute, which is a likely occurrence given normal moderation workflows. There is no current public evidence of in-the-wild exploitation, but the ease of exploitation makes this a priority.

Remediation

Site administrators should immediately update the Webmention plugin to a patched version beyond 5.8.0 that includes proper input sanitization and output escaping. Verify against the official plugin repository or vendor advisory for the specific patched version. As a temporary mitigation, administrators can disable webmention functionality or restrict webmention sources to trusted domains. Additionally, limit administrative access to comment moderation screens and review recent comments for signs of malicious content, particularly those with unusual avatar or URL metadata.

Patch guidance

Update the Webmention plugin through the WordPress admin dashboard or by downloading the latest version directly from the official WordPress plugin repository. Ensure the update is applied to a version that addresses the sanitization and escaping deficiencies. After patching, verify that webmention functionality is operational and test with sample webmentions to confirm proper behavior. No data migration or configuration changes are required, though a review of existing comments with suspicious metadata is recommended.

Detection guidance

Monitor WordPress comment creation logs for webmention entries containing script tags, event handlers (onclick, onerror, onload), or HTML-encoded payloads in author metadata fields. Check the wp_comments table for comments with avatar or url fields containing unusual characters, encoded entities, or obvious XSS patterns. Review WordPress admin access logs for comment edit screen access around the time suspicious webmentions were received. Look for database queries or API calls to the webmention REST endpoint (typically /wp-json/webmention/...) with malicious payloads in request bodies.

Why prioritize this

This vulnerability merits urgent attention due to its combination of unauthenticated access, stored persistence, high CVSS score (7.2), and low exploitation complexity. While the attack requires a privileged user interaction, that interaction is routine in WordPress administration. The scope of impact extends beyond the plugin to the entire website, and the attack vector does not require user interaction at the exploit delivery stage. Organizations running Webmention should prioritize patching within days, not weeks.

Risk score, explained

The CVSS 3.1 score of 7.2 (HIGH) reflects a network-accessible vulnerability with no privilege or user interaction required for delivery, though exploitation does require a privileged user to view the affected interface. The impact is moderate to high—confidentiality and integrity are affected (C:L/I:L), but availability is not directly impacted. The 'Changed Scope' (S:C) indicates the vulnerability can affect resources beyond the vulnerable component (the entire WordPress site). The score appropriately elevates this above medium due to the unauthenticated attack vector and persistence mechanism.

Frequently asked questions