# Link Whisper Free <= 0.9.7 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'wpil_admin_frontend_data' Parameter

- **ID:** WPSEC-2026-0863
- **Plugin:** Link Whisper Free (`link-whisper`), https://wordpress.org/plugins/link-whisper/
- **Affected versions:** all versions before 0.9.8
- **Fixed in:** 0.9.8 (Update to 0.9.8 or later.)
- **Severity:** Medium 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/link-whisper
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0863/

## Description

The Link Whisper Free plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'wpil_admin_frontend_data' parameter in all versions up to, and including, 0.9.7. This is due to the admin front-end script decoding the 'scrollLink.url' value from that parameter with jQuery's .html(), which builds live HTML elements when the value contains style or link tags. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user with access to Link Whisper (Editor-level by default) into clicking a crafted link.

## References

- https://wpsec.com/vuln/WPSEC-2026-0863/
- https://plugins.svn.wordpress.org/link-whisper/tags/0.9.8/
- https://wordpress.org/plugins/link-whisper/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0863/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.