CVE-2025-62970
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The Link Whisper Free plugin by Spencer Haws has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 0.9.2.
Risk Assessment
Unauthorized users may access link management functions or data, potentially leading to confidentiality breaches or unauthorized modifications.
Recommendation
Update the Link Whisper Free plugin to the latest patched version.
Other vulnerabilities in Link Whisper Free
See all- CVE-2026-57333High
The Link Whisper Free plugin version 0.9.4 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without requiring authentication.
- CVE-2026-14601Medium
The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks.
- CVE-2025-11262High
The Link Whisper Free plugin for WordPress up to version 0.9.0 is vulnerable to stored XSS via the user_id parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary scripts that execute whenever a user visits an affected page.
Original NVD description (English source)
Missing Authorization vulnerability in Spencer Haws Link Whisper Free link-whisper allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Link Whisper Free: from n/a through <= 0.9.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS