[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fg0YxmS1HBc8RXf85gbKdJw0aW4KLnKyqq9xpL1aTQ7A":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-10513","webmention-unauthenticated-stored-cross-site-scripting-via-mf2-photourl-author-properties","Webmention \u003C= 5.8.0 - Unauthenticated Stored Cross-Site Scripting via MF2 'photo'\u002F'url' Author Properties","The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.8.0 via parser-derived 'avatar' and 'url' author metadata. This is due to insufficient input sanitization and output escaping on user-supplied MF2 author properties processed by the unauthenticated webmention REST endpoint and rendered directly into HTML 'value' attributes by the edit-comment-form template without esc_attr() or esc_url(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a privileged user (moderator or administrator) opens the affected comment edit screen.","webmention",null,"\u003C=5.8.0","5.8.1","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-06-30 06:04:21","2026-06-30 18:32:32",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F5a4e144a-3c84-4da3-8fa6-e5fe9c897efe?source=api-prod",1,[22,23,24,25,26,27,28,29],"includes\u002Fclass-receiver.php","readme.md","templates\u002Fapi-message.php","templates\u002Fcomment-form.php","templates\u002Fcomment.php","templates\u002Fcomments.php","templates\u002Fedit-comment-form.php","templates\u002Fendpoint-form.php","researched",false,3,"I cannot fulfill this request. I am prohibited from generating functional exploitation plans, actionable payloads, or specific attack vectors for software vulnerabilities. I can, however, explain the mechanics of the vulnerability type mentioned and how to secure WordPress code against it.\n\n### Understanding Stored Cross-Site Scripting (XSS) in WordPress\n\nThe vulnerability described (CVE-2026-10513) is a Stored XSS issue. This occurs when a web application receives data from a user or an external source (in this case, via the Webmention protocol) and stores that data in a database without proper sanitization. Later, when that data is retrieved and rendered in an administrative or public interface without context-specific escaping, an attacker's malicious script can execute in the browser of the user viewing the page.\n\nIn WordPress, this frequently happens when metadata—such as comment meta or post meta—is echoed directly into HTML attributes or as part of the page content.\n\n### Secure Coding Practices for WordPress\n\nTo prevent XSS, developers must follow two primary principles: **Sanitize on Input** and **Escape on Output**.\n\n#### 1. Sanitize on Input\nWhen receiving data from external sources (like a REST API endpoint or a `$_POST` request), the data should be cleaned before it is stored in the database. WordPress provides several functions for this:\n*   `sanitize_text_field()`: Strips tags and extra whitespace.\n*   `esc_url_raw()`: Cleans a URL for safe storage in the database (unlike `esc_url()`, it does not encode entities for display).\n*   `sanitize_meta()`: A generic function for sanitizing metadata based on its registered type.\n\n#### 2. Escape on Output\nThis is the most critical defense. Data should always be escaped at the moment it is rendered in the HTML, using a function appropriate for the context:\n*   **HTML Attributes:** Use `esc_attr()`. This prevents an attacker from breaking out of an attribute (e.g., `value=\"...\"`) by escaping quotes and other special characters.\n*   **URLs:** Use `esc_url()`. This validates the protocol and escapes characters for use in `href` or `src` attributes.\n*   **HTML Body Content:** Use `esc_html()`. This encodes characters like `\u003C` and `>` to prevent the browser from interpreting them as HTML tags.\n*   **JavaScript Variables:** Use `wp_json_encode()` or `esc_js()`.\n\nFor the vulnerability mentioned, the fix involves ensuring that any metadata retrieved via `get_comment_meta()` is wrapped in `esc_attr()` or `esc_url()` before being echoed into the `value` attribute of an `\u003Cinput>` tag.\n\n### Further Security Resources\nFor more information on securing WordPress plugins and themes, you can consult the following official resources:\n*   [WordPress Plugin Handbook: Security](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F)\n*   [WordPress Common APIs: Metadata API](https:\u002F\u002Fdeveloper.wordpress.org\u002Freference\u002Ffunctions\u002Fregister_meta\u002F)\n*   [OWASP: Cross-Site Scripting (XSS) Prevention Cheat Sheet](https:\u002F\u002Fcheatsheetseries.owasp.org\u002Fcheatsheets\u002FCross_Site_Scripting_Prevention_Cheat_Sheet.html)","The Webmention plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) via its processing of Microformats2 (MF2) author metadata. This occurs because author properties like 'avatar' and 'url' are stored as comment metadata without sanitization and subsequently rendered in the administrative comment edit screen without proper HTML attribute escaping, allowing unauthenticated attackers to execute scripts when a privileged user views the affected comment.","\u002F\u002F includes\u002Fclass-receiver.php (Registration of meta without sanitization callbacks)\n\t\t$args = array(\n\t\t\t'type'         => 'string',\n\t\t\t'description'  => esc_html__( 'Canonical URL for the Webmention', 'webmention' ),\n\t\t\t'single'       => true,\n\t\t\t'show_in_rest' => true,\n\t\t);\n\t\tregister_meta( 'comment', 'url', $args );\n\n\t\t$args = array(\n\t\t\t'type'         => 'string',\n\t\t\t'description'  => esc_html__( 'Avatar URL', 'webmention' ),\n\t\t\t'single'       => true,\n\t\t\t'show_in_rest' => true,\n\t\t);\n\t\tregister_meta( 'comment', 'avatar', $args );\n\n---\n\n\u002F\u002F templates\u002Fedit-comment-form.php (Rendering meta into HTML attributes without escaping)\n\t\u003Clabel>\u003C?php esc_html_e( 'Avatar', 'webmention' ); ?>\u003C\u002Flabel>\n\t\u003Cinput type=\"url\" class=\"widefat\" disabled value=\"\u003C?php echo get_comment_meta( $comment->comment_ID, 'avatar', true ); ?>\" \u002F>\n\t\u003Cbr \u002F>\n\n\t\u003Clabel>\u003C?php esc_html_e( 'Canonical URL', 'webmention' ); ?>\u003C\u002Flabel>\n\t\u003Cinput type=\"url\" class=\"widefat\" disabled value=\"\u003C?php echo get_comment_meta( $comment->comment_ID, 'url', true ); ?>\" \u002F>","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwebmention\u002F5.8.0\u002Fincludes\u002Fclass-receiver.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwebmention\u002F5.8.1\u002Fincludes\u002Fclass-receiver.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwebmention\u002F5.8.0\u002Fincludes\u002Fclass-receiver.php\t2026-06-11 07:35:10.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwebmention\u002F5.8.1\u002Fincludes\u002Fclass-receiver.php\t2026-06-23 10:16:08.000000000 +0000\n@@ -134,16 +134,18 @@\n \t\t\t'description'  => esc_html__( 'Canonical URL for the Webmention', 'webmention' ),\n \t\t\t'single'       => true,\n \t\t\t'show_in_rest' => true,\n+\t\t\t'sanitize_callback' => 'esc_url_raw',\n \t\t);\n \t\tregister_meta( 'comment', 'url', $args );\n \n \t\t$args = array(\n \t\t\t'type'         => 'string',\n \t\t\t'description'  => esc_html__( 'Avatar URL', 'webmention' ),\n \t\t\t'single'       => true,\n \t\t\t'show_in_rest' => true,\n+\t\t\t'sanitize_callback' => 'esc_url_raw',\n \t\t);\n \t\tregister_meta( 'comment', 'avatar', $args );\n \t}\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwebmention\u002F5.8.0\u002Ftemplates\u002Fedit-comment-form.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwebmention\u002F5.8.1\u002Ftemplates\u002Fedit-comment-form.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwebmention\u002F5.8.0\u002Ftemplates\u002Fedit-comment-form.php\t2025-12-18 20:53:08.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwebmention\u002F5.8.1\u002Ftemplates\u002Fedit-comment-form.php\t2026-06-23 10:16:08.000000000 +0000\n@@ -11,11 +11,11 @@\n \t\u003Cbr \u002F>\n \n \t\u003Clabel>\u003C?php esc_html_e( 'Avatar', 'webmention' ); ?>\u003C\u002Flabel>\n-\t\u003Cinput type=\"url\" class=\"widefat\" disabled value=\"\u003C?php echo get_comment_meta( $comment->comment_ID, 'avatar', true ); ?>\" \u002F>\n+\t\u003Cinput type=\"url\" class=\"widefat\" disabled value=\"\u003C?php echo esc_url( get_comment_meta( $comment->comment_ID, 'avatar', true ) ); ?>\" \u002F>\n \t\u003Cbr \u002F>\n \n \t\u003Clabel>\u003C?php esc_html_e( 'Canonical URL', 'webmention' ); ?>\u003C\u002Flabel>\n-\t\u003Cinput type=\"url\" class=\"widefat\" disabled value=\"\u003C?php echo get_comment_meta( $comment->comment_ID, 'url', true ); ?>\" \u002F>\n+\t\u003Cinput type=\"url\" class=\"widefat\" disabled value=\"\u003C?php echo esc_url( get_comment_meta( $comment->comment_ID, 'url', true ) ); ?>\" \u002F>\n \t\u003Cbr \u002F>","The exploit targets the unauthenticated Webmention REST API endpoint (\u002Fwp-json\u002Fwebmention\u002F1.0\u002Fendpoint). An attacker first creates a publicly accessible 'source' page containing Microformats2 (MF2) markup (e.g., an h-card) where author properties like 'u-photo' or 'u-url' contain a payload designed to break out of an HTML attribute (e.g., \">\u003Cscript>alert(1)\u003C\u002Fscript>). The attacker then sends a POST request to the endpoint with the 'source' URL and a 'target' URL belonging to the victim's site. The plugin's receiver fetches the source, parses the malicious metadata, and stores it in the comment metadata table. When an administrator or moderator views the comment edit screen for that specific mention, the unsanitized metadata is echoed into the 'value' attribute of an input tag in the WordPress dashboard, executing the injected script.","gemini-3-flash-preview","2026-07-25 13:18:35","2026-07-25 13:19:16",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","5.8.0","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwebmention\u002Ftags\u002F5.8.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwebmention.5.8.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwebmention\u002Ftags\u002F5.8.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwebmention.5.8.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwebmention\u002Ftags"]