CVE-2025-11263
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Link Whisper Free plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the type parameter in all versions up to, and including, 0.8.8 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can successfully trick a user into performing an action such as clicking a link.
Risk Assessment
An unauthenticated attacker can trick a user into clicking a specially crafted link, leading to execution of malicious code in the victim's browser and potential session data theft.
Recommendation
Update the Link Whisper Free plugin to a version newer than 0.8.8 or remove it if unused. Additionally, educate users about not clicking suspicious links.
Other vulnerabilities in Link Whisper Free
See all- CVE-2026-109688Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free (link-whisper) allows Blind SQL Injection. This issue affects Link Whisper Free from n/a through 0.9.7.
- CVE-2026-109686Critical
The Link Whisper Free WordPress plugin in versions up to 0.9.7 contains a deserialization of untrusted data vulnerability that allows an attacker to perform object injection. The issue occurs in the plugin's input processing mechanism.
- CVE-2026-109685High
The Link Whisper Free plugin in versions up to 0.9.7 contains a Reflected XSS vulnerability due to improper neutralization of input during web page generation.
- CVE-2026-109687High
Blind SQL Injection vulnerability in Link Whisper Free plugin. Improper neutralization of special elements in SQL command allows blind SQL injection.
- CVE-2026-14601Medium
The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks.
- CVE-2026-57333High
The Link Whisper Free plugin version 0.9.4 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without requiring authentication.
- CVE-2025-11262High
The Link Whisper Free plugin for WordPress up to version 0.9.0 is vulnerable to stored XSS via the user_id parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary scripts that execute whenever a user visits an affected page.
- CVE-2025-62970Medium
The Link Whisper Free plugin by Spencer Haws has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 0.9.2.
Original NVD description (English source)
The Link Whisper Free plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the type parameter in all versions up to, and including, 0.8.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS