Link Whisper Free <= 0.9.7 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'wpil_admin_frontend_data' Parameter

ID

WPSEC-2026-0863

Plugin

Link Whisper Free (link-whisper)

Affected

all versions before 0.9.8

Remediation

Update to 0.9.8 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness

CWE-79

Usage

Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-13

Attack surface

Link Whisper Free on WPSec AttackSurface

Fix released

2026-10-13

Published

2026-10-14

Description

The Link Whisper Free plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'wpil_admin_frontend_data' parameter in all versions up to, and including, 0.9.7. This is due to the admin front-end script decoding the 'scrollLink.url' value from that parameter with jQuery's .html(), which builds live HTML elements when the value contains style or link tags. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user with access to Link Whisper (Editor-level by default) into clicking a crafted link.

References

• https://wpsec.com/vuln/WPSEC-2026-0863/
• https://plugins.svn.wordpress.org/link-whisper/tags/0.9.8/
• https://wordpress.org/plugins/link-whisper/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS