CVE-2026-10513 describes a stored XSS vulnerability in the pfefferle Webmention WordPress plugin versions up to 5.8.0. The issue stems from insufficient input sanitization and output escaping of Microformats2 (MF2) author properties, specifically 'avatar' and 'url', which are processed by an unauthenticated webmention REST endpoint. These malicious inputs are rendered directly into HTML 'value' attributes in the edit-comment-form template without using esc_attr() or esc_url(), allowing arbitrary script injection. The vulnerability enables unauthenticated attackers to execute scripts in the context of privileged users (moderators or administrators) when they open the affected comment edit screen.

Successful exploitation allows unauthenticated attackers to conduct stored XSS attacks that execute arbitrary scripts in the browser of privileged users. This can lead to session hijacking, privilege escalation, or other malicious actions performed with the privileges of moderators or administrators. The CVSS 3.1 base score is 7.2 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality and integrity with no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the comment edit screen to trusted users only and consider disabling the Webmention plugin if possible. Monitor vendor channels for updates and apply any official patches or temporary fixes once released.