Executive brief
Link Whisper Free is a WordPress plugin used to automate internal linking for SEO purposes. A security flaw allows unauthenticated attackers to inject malicious scripts into the website via a vulnerable user ID parameter. If exploited, these scripts will execute in the browsers of visitors or administrators who view the affected pages, potentially leading to unauthorized actions or data theft.
Technical details
The Link Whisper Free plugin for WordPress (versions up to and including 0.9.0) is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'user_id' parameter. An unauthenticated attacker can send a specially crafted request to inject arbitrary JavaScript into the application's database. This script is then executed in the security context of any user (including administrators) who navigates to the page where the malicious data is rendered. The vulnerability is tracked as CWE-79 and carries a CVSS score of 7.2, reflecting its high impact and lack of authentication requirements.
Affected products
- Spencer Haws Link Whisper Free Up to, and including, 0.9.0
Timeline
- 2026-05-29: disclosed: CVE published by Wordfence and NVD