CVE-2025-11262
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The Link Whisper Free plugin for WordPress up to version 0.9.0 is vulnerable to stored XSS via the user_id parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary scripts that execute whenever a user visits an affected page.
Risk Assessment
An attacker can inject malicious JavaScript, leading to session hijacking, phishing redirects, or website defacement. The risk is high because the attack requires no authentication and the script executes on every page load.
Recommendation
Immediately update the Link Whisper Free plugin to the latest available version. If an update is not possible, temporarily disable the plugin until a patch is released.
Other vulnerabilities in Link Whisper Free
See all- CVE-2026-57333High
The Link Whisper Free plugin version 0.9.4 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without requiring authentication.
- CVE-2026-14601Medium
The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks.
Original NVD description (English source)
The Link Whisper Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 0.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.