What is the CVSS score of CVE-2025-11262?

CVE-2025-11262 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Link Whisper Free are affected by CVE-2025-11262?

Link Whisper Free WordPress plugin (versions through 0.9.0) contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious JavaScript into site pages,…

How to fix or mitigate CVE-2025-11262?

Within 24 hours: Disable Link Whisper Free plugin across all affected WordPress instances immediately. Within 7 days: Evaluate alternative SEO plugins; contact vendor to confirm patch timeline; audit all potentially compromised pages for injected scripts. Within 30 days: Deploy Web Application Firewall rules to filter/validate user_id parameter input; monitor vendor advisories for patch availability and establish logging for exploitation attempts.

Link Whisper Free CVE-2025-11262

EUVD-2025-209983 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-29 Wordfence

GHSA-7h4c-hr9j-8q85

XSS WordPress

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 08:14 vuln.today

CVE Published

May 29, 2026 - 06:43 nvd

HIGH 7.2

DescriptionCVE.org

The Link Whisper Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 0.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in the Link Whisper Free WordPress plugin (versions through 0.9.0) allows unauthenticated remote attackers to inject persistent JavaScript via the user_id parameter, which executes in the browser of any user who visits an affected page. The flaw stems from insufficient input sanitization and output escaping in the plugin's settings handler, and no public exploit identified at time of analysis. With a CVSS 7.2 score reflecting Scope:Changed impact, the bug is notable because exploitation requires no authentication despite affecting an administrative-adjacent plugin component.

Technical ContextAI

Link Whisper Free is a WordPress plugin (CPE: cpe:2.3:a:linkwhspr:link_whisper_free) that automates internal linking suggestions for content authors. The vulnerability is a CWE-79 (Improper Neutralization of Input During Web Page Generation) issue located in core/Wpil/Settings.php around line 883, where the user_id parameter is accepted from a request and rendered into page output without proper sanitization (e.g., sanitize_text_field, absint) or contextual escaping (esc_html, esc_attr). Because the injected script is persisted and later rendered to other visitors, it qualifies as Stored XSS rather than Reflected, increasing impact in scenarios where an administrator views the affected page and triggers privileged actions in their browser context.

RemediationAI

Patch available per vendor advisory - upgrade Link Whisper Free to a release newer than 0.9.0 as published on https://wordpress.org/plugins/link-whisper/ (consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ad159b18-0ad1-4cab-932e-6850cf7a867f for the exact fixed version, which was not enumerated in the provided input). If immediate patching is not feasible, deactivate the Link Whisper Free plugin until upgrade is possible (trade-off: loss of internal-linking automation), or place the WordPress site behind a WAF such as Wordfence with XSS rules enabled and restrict access to the plugin's settings endpoint (typically wp-admin/admin.php?page=link-whisper) by IP allow-list at the web server level (trade-off: legitimate authors lose remote access). Additionally, audit existing plugin-managed pages and settings entries for previously-injected <script>, on*= handlers, or javascript: URIs and purge them, since stored XSS payloads persist after patching.