WebSub (FKA. PubSubHubbub)
WebSub (FKA. PubSubHubbub) has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of September 2026. Their average CVSS score is 4.4, and the most serious one scores 4.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for WebSub (FKA. PubSubHubbub) has a vendor fix available, so running the current release closes it.
All of these findings were reported by catfather. WebSub (FKA. PubSubHubbub) is installed on roughly 100,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2024-0688WebSub (FKA. PubSubHubbub) <= 3.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

WebSub (FKA. PubSubHubbub)
Author
joshfraz
This plugin implements the WebSub protocol (formerly known as PubSubHubbub) for WordPress. It enables real-time notifications when your blog is updated and provides a subscriber API for other plugins to consume WebSub-enabled feeds. Publisher Features When you publish or update a post, this plugin automatically notifies WebSub hubs, which then distribute the update to all subscribers in real-time. Sends realtime notifications when you update your blog Supports multi-user installations (WordPress MU) Supports multiple hubs Supports all feed formats used by WordPress (Atom, RSS2, RDF) Adds <link rel="hub"> and <link rel="self"> declarations to feeds and HTML Subscriber Features The plugin provides a subscriber API that allows other plugins (like feed readers) to subscribe to WebSub-enabled feeds using WordPress hooks. REST API callback endpoint for subscription verification and content delivery Hub discovery from topic URLs (HTTP Link headers and feed content) HMAC signature verification (SHA1, SHA256, SHA384, SHA512) Full lifecycle hooks for integration with other plugins Supported Specifications WebSub W3C Recommendation PubSubHubbub 0.4 Default Hubs By default this plugin will ping the following hubs: Demo hub on Google App Engine SuperFeedr WebSubHub Please contact us if you operate a hub that you would like to be included as a default option.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C