CVE-2026-111109 pfefferle CVE debrief

Who should care

WordPress administrators and users who have the Webmention plugin installed should assess exposure and prioritize verification of affected versions and remediation. Successful exploitation requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.

Why it matters

The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting, allowing unauthenticated attackers to inject arbitrary web scripts. WordPress administrators and users should assess exposure and prioritize verification of affected versions and remediation.

• Unauthenticated attackers can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page
• Successful exploitation requires an action by an administrator — the attacker cannot trigger the vulnerability on their own
• Administrators should verify if the Webmention plugin version is 5.10.1 or earlier and prioritize remediation
• Remediation priority is high due to the potential for Stored Cross-Site Scripting attacks

Technical summary

The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Graph og:title meta tag of a webmention source URL in versions up to, and including, 5.10.1. This is due to insufficient input sanitization: Meta::add_properties() maps og:title to the Item::name property, but Item has no concrete set_name() method, so Item::__call() stores the value raw while sibling set_content()/set_summary() paths route through webmention_sanitize_html(); Item::get_content() then falls back to the raw name when content and summary are empty.

Defensive priority

WordPress administrators and users should assess exposure and prioritize verification of affected versions and remediation.

Recommended defensive actions

• Assess exposure by verifying if the Webmention plugin version is 5.10.1 or earlier
• Prioritize remediation by updating to a fixed version
• Monitor for suspicious activity and implement compensating controls
• Verify administrator approval of pending webmention comments
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Graph og:title meta tag of a webmention source URL in versions up to, and including, 5.10.1. This is due to insufficient input sanitization: Meta::add_properties() maps og:title to the Item::name property, but Item has no concrete set_name() method, so Item::__call() stores the value raw while sibling set_content()/

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.