Webmention vulnerabilities

2 known vulnerabilities in Webmention from Pfefferle. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  Webmention: Improper Neutralization of Input During Web Page Generation

  CVE-2026-10513Jun 30, 2026Pfefferle

  The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.8.0 via parser-derived 'avatar' and 'url' author metadata. This is due to insufficient input sanitization and output escaping on user-supplied MF

• 7.2 High severity

  Webmention: Server-Side Request Forgery

  CVE-2026-0686Apr 2, 2026Pfefferle

  The Webmention plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.6.2 in the 'MF2::parse_authorpage' function via the 'Receiver::post' function. This makes it possible for unauthenticated attackers to make