EUVD-2025-209983
GHSA-7h4c-hr9j-8q85
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Link Whisper Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 0.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored cross-site scripting in the Link Whisper Free WordPress plugin (versions through 0.9.0) allows unauthenticated remote attackers to inject persistent JavaScript via the user_id parameter, which executes in the browser of any user who visits an affected page. The flaw stems from insufficient input sanitization and output escaping in the plugin's settings handler, and no public exploit identified at time of analysis. With a CVSS 7.2 score reflecting Scope:Changed impact, the bug is notable because exploitation requires no authentication despite affecting an administrative-adjacent plugin component.
Technical ContextAI
Link Whisper Free is a WordPress plugin (CPE: cpe:2.3:a:linkwhspr:link_whisper_free) that automates internal linking suggestions for content authors. The vulnerability is a CWE-79 (Improper Neutralization of Input During Web Page Generation) issue located in core/Wpil/Settings.php around line 883, where the user_id parameter is accepted from a request and rendered into page output without proper sanitization (e.g., sanitize_text_field, absint) or contextual escaping (esc_html, esc_attr). Because the injected script is persisted and later rendered to other visitors, it qualifies as Stored XSS rather than Reflected, increasing impact in scenarios where an administrator views the affected page and triggers privileged actions in their browser context.
RemediationAI
Patch available per vendor advisory - upgrade Link Whisper Free to a release newer than 0.9.0 as published on https://wordpress.org/plugins/link-whisper/ (consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ad159b18-0ad1-4cab-932e-6850cf7a867f for the exact fixed version, which was not enumerated in the provided input). If immediate patching is not feasible, deactivate the Link Whisper Free plugin until upgrade is possible (trade-off: loss of internal-linking automation), or place the WordPress site behind a WAF such as Wordfence with XSS rules enabled and restrict access to the plugin's settings endpoint (typically wp-admin/admin.php?page=link-whisper) by IP allow-list at the web server level (trade-off: legitimate authors lose remote access). Additionally, audit existing plugin-managed pages and settings entries for previously-injected <script>, on*= handlers, or javascript: URIs and purge them, since stored XSS payloads persist after patching.
More in Link Whisper Free
View allSQL injection in the Link Whisper Free WordPress plugin (all versions before 0.9.7) enables authenticated users holding
Unauthenticated attackers can modify plugin settings via a publicly accessible REST endpoint in Link Whisper Free WordPr
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper Link
Reflected cross-site scripting in the Link Whisper Free WordPress plugin (versions 0.9.4 and earlier) lets an unauthenti
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today