Description
The Link Whisper Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 0.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2026-05-29
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Link Whisper Free plugin for WordPress is vulnerable to stored cross‑site scripting through the user_id parameter. Insufficient input sanitization and output escaping allow an unauthenticated attacker to inject arbitrary JavaScript that is saved in the database and executed whenever a user loads an affected page.

Affected Systems

The vulnerability applies to all releases of the Link Whisper Free plugin up to and including version 0.9.0. Any WordPress site that has installed a version of the plugin within this range and has not applied an update that removes the flaw is affected.

Risk and Exploitability

The CVSS score of 7.2 indicates medium‑to‑high severity. The flaw has no authentication requirement, meaning any internet user can exploit it. EPSS data is not available, but the widespread use of the plugin and the nature of stored cross‑site scripting make it a realistic threat. The vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on May 29, 2026 at 08:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Link Whisper Free to the latest plugin version that includes a fix for the user_id sanitization issue.
  • If an update is not available, deactivate or uninstall the plugin to eliminate the attack surface.
  • If the plugin must remain in use and cannot be upgraded, modify the plugin code to properly escape the user_id parameter before storing or rendering it to mitigate the stored XSS risk.

Generated by OpenCVE AI on May 29, 2026 at 08:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 29 May 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Linkwhisper
Linkwhisper link Whisper Free
Wordpress
Wordpress wordpress
Vendors & Products Linkwhisper
Linkwhisper link Whisper Free
Wordpress
Wordpress wordpress

Fri, 29 May 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 29 May 2026 07:45:00 +0000

Type Values Removed Values Added
Description The Link Whisper Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 0.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title Link Whisper Free <= 0.9.0 - Unauthenticated Stored Cross-Site Scripting
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Linkwhisper Link Whisper Free
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-05-29T10:05:36.023Z

Reserved: 2025-10-03T14:09:32.758Z

Link: CVE-2025-11262

cve-icon Vulnrichment

Updated: 2026-05-29T10:05:31.002Z

cve-icon NVD

Status : Deferred

Published: 2026-05-29T08:16:17.497

Modified: 2026-05-29T13:09:05.450

Link: CVE-2025-11262

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-29T14:30:36Z

Weaknesses