Vulnerabilities / Link Whisper Free / WPSEC-2026-0866
Link Whisper Free <= 0.9.7 - Unauthenticated CSV Injection via Click Tracking Anchor Text
Medium 5.4
CWE-1236Fixed in 0.9.8
- ID
- WPSEC-2026-0866
- Plugin
- Link Whisper Free (link-whisper)
- Affected
- all versions before 0.9.8
- Remediation
- Update to 0.9.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- Weakness
- CWE-1236
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-13
- Attack surface
- Link Whisper Free on WPSec AttackSurface
- Fix released
- Published
Description
The Link Whisper Free plugin for WordPress is vulnerable to CSV Injection via the link anchor text recorded by the click tracking feature in all versions up to, and including, 0.9.7. This is due to insufficient neutralization of formula characters when click data is written to the clicks CSV export. This makes it possible for unauthenticated attackers to submit click data containing spreadsheet formulas that run when a site user exports the clicks report and opens it in a spreadsheet application.
References
- https://wpsec.com/vuln/WPSEC-2026-0866/
- https://plugins.svn.wordpress.org/link-whisper/tags/0.9.8/
- https://wordpress.org/plugins/link-whisper/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS