CVE-2026-109688

The Link Whisper Free plugin in versions up to 0.9.7 contains a Reflected XSS vulnerability due to improper neutralization of input during web page generation.

The Link Whisper Free plugin version 0.9.4 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without requiring authentication.

The Link Whisper Free WordPress plugin in versions up to 0.9.7 contains a deserialization of untrusted data vulnerability that allows an attacker to perform object injection. The issue occurs in the plugin's input processing mechanism.

Blind SQL Injection vulnerability in Link Whisper Free plugin. Improper neutralization of special elements in SQL command allows blind SQL injection.

The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks.

The Link Whisper Free plugin for WordPress up to version 0.9.0 is vulnerable to stored XSS via the user_id parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary scripts that execute whenever a user visits an affected page.

The Link Whisper Free plugin by Spencer Haws has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 0.9.2.