{
 "id": "WPSEC-2026-0866",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0866/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0866/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0866/index.md",
 "title": "Link Whisper Free <= 0.9.7 - Unauthenticated CSV Injection via Click Tracking Anchor Text",
 "description": "The Link Whisper Free plugin for WordPress is vulnerable to CSV Injection via the link anchor text recorded by the click tracking feature in all versions up to, and including, 0.9.7. This is due to insufficient neutralization of formula characters when click data is written to the clicks CSV export. This makes it possible for unauthenticated attackers to submit click data containing spreadsheet formulas that run when a site user exports the clicks report and opens it in a spreadsheet application.",
 "plugin": {
  "slug": "link-whisper",
  "name": "Link Whisper Free",
  "full_name": "Link Whisper Free",
  "wordpress_org": "https://wordpress.org/plugins/link-whisper/",
  "advisories_url": "https://wpsec.com/vuln/plugin/link-whisper/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/link-whisper"
 },
 "type": "CSV INJECTION",
 "cwe": [
  "CWE-1236"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "0.9.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 0.9.8"
  ]
 },
 "introduced_in": null,
 "fixed_in": "0.9.8",
 "remediation": "Update to 0.9.8 or later.",
 "fix_released": "2026-10-13T02:18:51+00:00",
 "published": "2026-10-14T02:42:48+00:00",
 "updated": "2026-10-13T12:12:46.000627+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0866/",
  "https://plugins.svn.wordpress.org/link-whisper/tags/0.9.8/",
  "https://wordpress.org/plugins/link-whisper/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/link-whisper",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-13"
 }
}