WordPress Plugin Vulnerabilities

Link Whisper Free < 0.9.1 - Unauthenticated Stored Cross-Site Scripting

Description

The Link Whisper Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 0.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
link-whisper
Fixed in 0.9.1

References

CVE
CVE-2025-11262
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/ad159b18-0ad1-4cab-932e-6850cf7a867f

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.2 (high)

Miscellaneous

Original Researcher
mikemyers
Verified
No
WPVDB ID
d3940c23-451b-4146-87d7-bae454a33da3

Timeline

Publicly Published
2026-05-28 (about 1 month ago)
Added
2026-05-28 (about 1 month ago)
Last Updated
2026-05-29 (about 1 month ago)

Other

Published
Title
Published
2026-01-13
Title
GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation < 1.1.9 - Unauthenticated Stored Cross-Site Scripting
Published
2014-08-01
Title
Springboard Video Quick Publish 0.2.6 - videolist.php paged Parameter Reflected XSS
Published
2025-01-16
Title
Easy EU Cookie law <= 1.3.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Published
2025-01-16
Title
CBX Accounting & Bookkeeping <= 1.3.14 - Reflected Cross-Site Scripting
Published
2015-05-20
Title
uDesign Theme 1.8.0-2.7.9 - DOM Cross-Site Scripting (XSS)