CVE-2026-10513 Overview
CVE-2026-10513 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Webmention plugin for WordPress. The flaw affects all versions up to and including 5.8.0 and stems from insufficient sanitization of parser-derived avatar and url author metadata. Unauthenticated attackers can inject arbitrary web scripts through the plugin's public REST endpoint. The scripts execute when a moderator or administrator opens the affected comment edit screen in wp-admin.
Critical Impact
Unauthenticated remote attackers can inject persistent JavaScript that executes in a privileged WordPress user's browser session, enabling account takeover, backend content manipulation, and further site compromise.
Affected Products
- WordPress Webmention plugin versions up to and including 5.8.0
- WordPress sites exposing the unauthenticated webmention REST endpoint
- Any WordPress installation where moderators or administrators access the comment edit screen
Discovery Timeline
- 2026-06-30 - CVE-2026-10513 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-10513
Vulnerability Analysis
The Webmention plugin implements the W3C Webmention specification, allowing WordPress sites to receive notifications when other sites link to them. It parses Microformats 2 (MF2) metadata from source URLs to extract author information, including avatar and url properties. These values are stored as comment metadata and later rendered in the comment editing interface.
The vulnerability originates in the MF2 handler at includes/handler/class-mf2.php and manifests in the template at templates/edit-comment-form.php. Author properties are written directly into HTML value attributes without calls to esc_attr() or esc_url(). Because the webmention receiver is an unauthenticated REST endpoint, any external actor can submit crafted MF2 payloads that reach the admin interface.
Exploitation results in script execution under the origin of the WordPress admin panel, giving the injected code full access to session cookies, nonces, and administrative functionality.
Root Cause
The root cause is missing output escaping on user-supplied MF2 data. The avatar and url fields extracted from remote MF2 documents are treated as trusted values. The edit-comment-form.php template concatenates these values into value="..." attributes without escaping, allowing attribute-breaking payloads such as " onerror=... x=" to execute JavaScript.
Attack Vector
An attacker hosts a malicious page containing MF2 markup with a hostile u-photo (avatar) or u-url value. The attacker then sends a webmention to the victim WordPress site referencing that page. The plugin fetches and parses the attacker's page, stores the malicious metadata against a comment, and later renders it unescaped when a privileged user opens the comment editor. See the WordPress Plugin Code Analysis and WordPress Plugin Template Review for the affected code paths.
No authentication, user interaction from the attacker side, or existing account is required. Interaction is required only from the privileged victim who opens the comment edit screen.
Detection Methods for CVE-2026-10513
Indicators of Compromise
- Inbound HTTP POST requests to the /wp-json/webmention/1.0/endpoint route from unfamiliar source hosts
- Comment metadata entries containing HTML control characters such as ", <, >, or onerror= in avatar or url author fields
- Webmention source URLs pointing to attacker-controlled pages with anomalous MF2 markup
- Unexpected outbound requests from administrator browsers immediately after opening comment edit screens
Detection Strategies
- Inspect the wp_commentmeta table for webmention_author_avatar or webmention_author_url values containing angle brackets, quotes, or javascript: schemes
- Enable WordPress access logging and alert on POST requests to the webmention REST endpoint from previously unseen referrers
- Review web server logs for MF2 parsing activity correlated with fetches to unusual external URLs
- Deploy a Content Security Policy in report-only mode on wp-admin to surface unexpected inline script execution
Monitoring Recommendations
- Monitor the plugin version reported by WordPress site health and alert when Webmention is at or below 5.8.0
- Track administrator session anomalies such as new API tokens, user creations, or plugin installations following comment moderation activity
- Log and review all webmention submissions, including source URL, target URL, and extracted author metadata
How to Mitigate CVE-2026-10513
Immediate Actions Required
- Update the Webmention plugin to a version above 5.8.0 that includes the fix from WordPress Changeset 3583033
- Audit existing comments and comment metadata for previously injected avatar or url payloads and remove malicious entries
- Rotate administrator and moderator credentials if evidence of exploitation is present
- Invalidate active WordPress admin sessions and review recently created users, application passwords, and plugin changes
Patch Information
The vendor addressed the issue by adding proper output escaping to the affected template and sanitizing MF2 author properties on ingestion. Refer to the Wordfence Vulnerability Report and the linked changeset for remediation specifics. Administrators should verify the installed version via wp plugin get webmention --field=version after updating.
Workarounds
- Disable the Webmention plugin until the update can be applied
- Restrict access to the /wp-json/webmention/1.0/endpoint route at the web server or WAF layer to trusted source domains
- Apply a WAF rule that blocks webmention submissions where fetched MF2 payloads contain HTML metacharacters in u-photo or u-url fields
# Update Webmention plugin using WP-CLI
wp plugin update webmention
wp plugin get webmention --field=version
# Temporary mitigation: deactivate the plugin
wp plugin deactivate webmention
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
