Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through 0.9.7.
Published: 2026-10-15
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting that could compromise user sessions or deface the site
Action: Immediate Patch
AI Analysis

Impact

This vulnerability is a reflected Cross‑Site Scripting flaw in the Link Whisper Free plugin for WordPress. Improper neutralization of input during web page generation allows an attacker to inject arbitrary script into pages that invoke the plugin. The injected script runs with the permissions of any user who views the affected page, potentially enabling cookie theft, session hijacking, or defacement of the site’s HTML.

Affected Systems

The flaw affects the Link Whisper INC Link Whisper Free plugin version 0.9.7 and all earlier releases. Any WordPress installation that has this plugin installed and enabled is vulnerable.

Risk and Exploitability

The CVSS score is 7.1, indicating high severity. The EPSS score is < 1%, meaning a very low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw through a crafted URL or input that is reflected by the plugin’s output, without requiring authentication or special privileges.

Generated by OpenCVE AI on October 16, 2026 at 21:49 UTC.

Remediation

Vendor Solution

Update the WordPress Link Whisper Free plugin to the latest available version (at least 0.9.8).

OpenCVE Recommended Actions

  • Upgrade the Link Whisper Free plugin to version 0.9.8 or later.
  • If an upgrade cannot be performed immediately, temporarily disable the plugin until the update is applied.
  • Deploy a web application firewall rule to filter or sanitize script payloads targeting the plugin’s output.

Generated by OpenCVE AI on October 16, 2026 at 21:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through 0.9.7.
Title WordPress Link Whisper Free plugin <= 0.9.7 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-16T14:39:07.227Z

Reserved: 2026-10-13T00:19:42.200Z

Link: CVE-2026-109685

cve-icon Vulnrichment

Updated: 2026-10-16T14:35:13.698Z

cve-icon NVD

Status : Deferred

Published: 2026-10-15T13:17:11.400

Modified: 2026-10-16T15:17:08.003

Link: CVE-2026-109685

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T22:00:16Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')