{
 "id": "WPSEC-2026-0863",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0863/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0863/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0863/index.md",
 "title": "Link Whisper Free <= 0.9.7 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'wpil_admin_frontend_data' Parameter",
 "description": "The Link Whisper Free plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'wpil_admin_frontend_data' parameter in all versions up to, and including, 0.9.7. This is due to the admin front-end script decoding the 'scrollLink.url' value from that parameter with jQuery's .html(), which builds live HTML elements when the value contains style or link tags. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user with access to Link Whisper (Editor-level by default) into clicking a crafted link.",
 "plugin": {
  "slug": "link-whisper",
  "name": "Link Whisper Free",
  "full_name": "Link Whisper Free",
  "wordpress_org": "https://wordpress.org/plugins/link-whisper/",
  "advisories_url": "https://wpsec.com/vuln/plugin/link-whisper/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/link-whisper"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "0.9.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 0.9.8"
  ]
 },
 "introduced_in": null,
 "fixed_in": "0.9.8",
 "remediation": "Update to 0.9.8 or later.",
 "fix_released": "2026-10-13T02:18:51+00:00",
 "published": "2026-10-14T02:42:48+00:00",
 "updated": "2026-10-13T12:12:46.000627+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0863/",
  "https://plugins.svn.wordpress.org/link-whisper/tags/0.9.8/",
  "https://wordpress.org/plugins/link-whisper/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/link-whisper",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-13"
 }
}