CVE-2026-57333
HighCVSS 7.1Summary
The Link Whisper Free plugin version 0.9.4 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without requiring authentication.
Risk Assessment
The risk involves the execution of arbitrary JavaScript code in the victim's browser, which can lead to session theft, redirects to malicious sites, or theft of sensitive data.
Recommendation
It is recommended to immediately update the Link Whisper Free plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in Link Whisper Free
See all- CVE-2026-14601Medium
The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks.
- CVE-2025-11262High
The Link Whisper Free plugin for WordPress up to version 0.9.0 is vulnerable to stored XSS via the user_id parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary scripts that execute whenever a user visits an affected page.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Link Whisper Free <= 0.9.4 versions.