What is the CVSS score of CVE-2026-57333?

CVE-2026-57333 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Link Whisper are affected by CVE-2026-57333?

Link Whisper Free, a widely-used WordPress internal linking plugin affecting versions 0.9.4 and earlier, contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers…

How to fix or mitigate CVE-2026-57333?

Within 24 hours: Inventory all WordPress instances running Link Whisper Free; identify versions 0.9.4 and earlier; review access logs and admin login activity for suspicious patterns or unauthorized access. Within 7 days: Uninstall or disable Link Whisper Free versions 0.9.4 and earlier on all affected sites; monitor Patchstack and vendor advisories for patch release; evaluate alternative internal linking plugins. Within 30 days: Implement replacement plugin if needed; force password reset for all WordPress administrative accounts; deploy Web Application Firewall rules to detect XSS patterns in HTTP referrer headers.

Link Whisper CVE-2026-57333

EUVD-2026-40104 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-29 Patchstack

GHSA-33cv-ffrg-w682

WordPress XSS Link Whisper Free Wordpress Plugin

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable reflected XSS needs no auth but requires victim click (UI:R); scope changes to the browser session (S:C) with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 15:16 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Link Whisper Free <= 0.9.4 versions.

AnalysisAI

Reflected cross-site scripting in the Link Whisper Free WordPress plugin (versions 0.9.4 and earlier) lets an unauthenticated remote attacker inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. The scope-change CVSS vector (S:C) indicates the injected script can affect resources beyond the vulnerable plugin context, such as the broader WordPress admin or site session. No public exploit identified at time of analysis, and it is not listed in CISA KEV; reported by Patchstack.

Technical ContextAI

Link Whisper is a WordPress internal-linking plugin (CPE cpe:2.3:a:spencer_haws:link_whisper_free) that suggests and inserts internal links across posts. The root cause is CWE-79 (improper neutralization of input during web page generation): user-supplied input is reflected back into an HTML response without proper output encoding or input sanitization, so attacker-controlled markup is rendered as active script by the victim's browser. Because this is a reflected variant, the malicious payload is delivered in the request (typically a URL parameter) and echoed into the immediate response rather than stored server-side.

RemediationAI

Upgrade Link Whisper Free to a release later than 0.9.4 once published by the vendor; the input data does not include an exact fixed version, so treat the patch as not independently confirmed and verify the fixed build against the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/link-whisper/vulnerability/wordpress-link-whisper-free-plugin-0-9-4-reflected-cross-site-scripting-xss-vulnerability) before deploying. Until a patched version is confirmed, deploy a web application firewall or WordPress security plugin with XSS request filtering to block reflected payloads in plugin parameters, restrict access to the affected plugin endpoints, and consider temporarily deactivating Link Whisper if it is not business-critical - noting that deactivation removes its internal-linking suggestions and any related admin functionality. Educating users not to click untrusted links targeting the site reduces the UI:R-dependent attack surface but is not a substitute for the fix.