CVE-2026-111109

The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Graph og:title meta tag of a webmention source URL in versions up to, and including, 5.10.1. This is due to insufficient input sanitization: Meta::addproperties maps og:title to the Item::name property,...

EUVD-2026-114592

The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Graph og:title meta tag of a webmention source URL in versions up to, and including, 5.10.1. This is due to insufficient input sanitization: Meta::addproperties maps og:title to the Item::name property,...

CVE-2026-111109 Webmention <= 5.10.1 - Unauthenticated Stored Cross-Site Scripting via Open Graph og:title Meta Tag

The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Graph og:title meta tag of a webmention source URL in versions up to, and including, 5.10.1. This is due to insufficient input sanitization: Meta::addproperties maps og:title to the Item::name property,...

CVE-2026-111109

The Webmention plugin for WordPress (versions up to and including 5.10.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization where the og:title meta tag from a webmention source URL is mapped to the Item::name property. Because Item lacks a con...

CVE-2026-111109 Webmention <= 5.10.1 - Unauthenticated Stored Cross-Site Scripting via Open Graph og:title Meta Tag

The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Graph og:title meta tag of a webmention source URL in versions up to, and including, 5.10.1. This is due to insufficient input sanitization: Meta::addproperties maps og:title to the Item::name property,...

CVE-2026-111109 Webmention <= 5.10.1 - Unauthenticated Stored Cross-Site Scripting via Open Graph og:title Meta Tag

The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Graph og:title meta tag of a webmention source URL in versions up to, and including, 5.10.1. This is due to insufficient input sanitization: Meta::addproperties maps og:title to the Item::name property,...

CVE-2026-111109: pfefferle Webmention: The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Graph og:title meta tag…

The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Graph og:title meta tag of a webmention source URL in versions up to, and including, 5.10.1. This is due to insufficient input sanitization: Meta::addproperties maps og:title to the Item::name property,...

PT-2026-134445

Name of the Vulnerable Software and Affected Versions Webmention plugin for WordPress versions prior to 5.10.2 Description Stored Cross-Site Scripting occurs via the Open Graph og:title meta tag of a webmention source URL. The issue stems from insufficient input sanitization where Meta::add...

CVE-2026-53468

Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields "og:title" and "og:description". An authenticated user with permission to...

PT-2026-79482

Name of the Vulnerable Software and Affected Versions Typemill versions prior to 2.23.0 Description Typemill is a flat-file, Markdown-based content management system for informational documentation websites. The software contains a stored HTML attribute injection flaw in the page metadata fields...

CVE-2026-53468: Improper Neutralization of Input During Web Page Generation

Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields og:title and og:description. An authenticated user with permission to modify...

Reddit: Blind SSRF to internal services in matrix preview_link API

A vulnerability was found in the previewlink functionality of Matrix software used in Reddit's new chat system. The endpoint allowed for partially blind SSRF, enabling attackers to send GET requests and exfiltrate data about internal services. This could potentially lead to service enumeration an...