Webmention vulnerabilities

CVEs whose affected-version data names the Webmention package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-111109Medium· 6.1

6d ago

Webmention <= 5.10.1 - Unauthenticated Stored Cross-Site Scripting via Open Graph og:title Meta Tag

The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Graph og:title meta tag of a webmention source URL in versions up to, and including, 5.10.1. This is due to insufficient input sanitization: Me…

▾ Sunlitpfefferle · WebmentionEPSS 0.28%via CVEORG