# Link Whisper Free <= 0.9.7 - Unauthenticated CSV Injection via Click Tracking Anchor Text

- **ID:** WPSEC-2026-0866
- **Plugin:** Link Whisper Free (`link-whisper`), https://wordpress.org/plugins/link-whisper/
- **Affected versions:** all versions before 0.9.8
- **Fixed in:** 0.9.8 (Update to 0.9.8 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-1236
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/link-whisper
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0866/

## Description

The Link Whisper Free plugin for WordPress is vulnerable to CSV Injection via the link anchor text recorded by the click tracking feature in all versions up to, and including, 0.9.7. This is due to insufficient neutralization of formula characters when click data is written to the clicks CSV export. This makes it possible for unauthenticated attackers to submit click data containing spreadsheet formulas that run when a site user exports the clicks report and opens it in a spreadsheet application.

## References

- https://wpsec.com/vuln/WPSEC-2026-0866/
- https://plugins.svn.wordpress.org/link-whisper/tags/0.9.8/
- https://wordpress.org/plugins/link-whisper/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0866/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.