Link Whisper Free CVE-2026-109685

Exploitation requires an attacker to deliver a crafted link/request to a victim and have that victim interact with it (UI:R) - the flaw is not self-triggering. The payload is reflected (not stored), so it is only effective when the victim is induced to follow the attacker-supplied URL while the vulnerable Link Whisper Free plugin (version 0.9.7 or earlier) is installed and active on the target WordPress site. Impact is maximized when the clicking victim holds an authenticated WordPress session (e.g., an administrator). No authentication is required of the attacker (PR:N), but the mandatory user-interaction step and the reflected (non-persistent) delivery are the primary limiting factors on realistic exploitation.

This is a reflected cross-site scripting flaw (CWE-79) in the Link Whisper Free WordPress plugin (versions through 0.9.7), reported by Patchstack. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) indicates a network-reachable, low-complexity, unauthenticated issue that nonetheless requires user interaction (UI:R) - the victim must be lured into triggering the malicious request, which materially lowers real-world risk versus a no-interaction flaw. The scope-change (S:C) and triple low impact reflect script execution in the victim's browser context rather than direct server compromise. No EPSS score, CISA KEV listing, POC, or SSVC data was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Patchstack-reported WordPress plugin XSS vulnerabilities are common, low-sophistication issues; this should be treated as a routine patch-management item (apply the fix in a normal cycle) rather than an emergency, with the caveat that the A:L (availability impact) in the vendor vector is unusual for reflected XSS and likely over-scored - reflected XSS normally has no availability impact.

An attacker crafts a URL to a vulnerable Link Whisper endpoint containing a malicious script payload in a reflected parameter and distributes it via phishing email, forum post, or malicious link. When a logged-in WordPress administrator or user clicks the link, the unsanitized input is reflected into the page and the script executes in their browser session, enabling session/cookie theft or actions in the WordPress admin context. No public exploit code was identified at time of analysis, and the attack depends on successfully social-engineering a victim into clicking (UI:R).