CVE-2025-11262
7.2 HIGHThe Link Whisper Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, ...
Published: 2026-05-29 · Last updated: 2026-05-29
Severity and scoring
- CVSS
- 7.2 HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- CWE
- CWE-79
Description
The Link Whisper Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 0.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2025-11262
- [Other]https://plugins.trac.wordpress.org/browser/link-whisper/trunk/core/Wpil/Settings.php#L883
- [Other]https://wordpress.org/plugins/link-whisper/#developers
- [Other]https://www.wordfence.com/threat-intel/vulnerabilities/id/ad159b18-0ad1-4cab-932e-6850cf7a867f?source=cve
Related CVEs
Same CWE
- CVE-2026-48157 — Slim is a PHP micro framework that enables users to write simple web applications and APIs (6.1 MEDIUM)
- CVE-2026-52702 — Unauthenticated Cross Site Scripting (XSS) in SEO Redirection <= 9.17 versions (7.1 HIGH)
- CVE-2026-49773 — Subscriber Cross Site Scripting (XSS) in FV Flowplayer Video Player < 7.5.51.7212 versions (6.5 MEDIUM)
- CVE-2026-49055 — Unauthenticated Cross Site Scripting (XSS) in Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.7 versions (7.1 HIGH)
- CVE-2026-48966 — Unauthenticated Cross Site Scripting (XSS) in Funnel Builder by FunnelKit <= 3.15.0.2 versions (7.1 HIGH)