EUVD-2026-40104
GHSA-33cv-ffrg-w682
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-reachable reflected XSS needs no auth but requires victim click (UI:R); scope changes to the browser session (S:C) with limited C/I/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Link Whisper Free <= 0.9.4 versions.
AnalysisAI
Reflected cross-site scripting in the Link Whisper Free WordPress plugin (versions 0.9.4 and earlier) lets an unauthenticated remote attacker inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. The scope-change CVSS vector (S:C) indicates the injected script can affect resources beyond the vulnerable plugin context, such as the broader WordPress admin or site session. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires no authentication (PR:N) but DOES require user interaction (UI:R): the attacker must lure a victim into clicking or loading a specially crafted URL pointing at the vulnerable Link Whisper Free endpoint (version 0.9.4 or earlier), where the malicious parameter is reflected unsanitized into the response. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.1 reflects a network attack vector with low complexity and no privileges required (AV:N/AC:L/PR:N), but exploitation requires user interaction (UI:R) - a victim must click or load the attacker's crafted link - which materially lowers real-world likelihood versus a no-interaction flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a URL to a vulnerable Link Whisper endpoint with a malicious script payload in a reflected parameter and sends it to a site administrator or visitor via email, comment, or chat. When the victim opens the link, the unsanitized payload executes in their browser session, allowing the attacker to steal session cookies, perform actions as the victim, or redirect them. … |
| Remediation | Upgrade Link Whisper Free to a release later than 0.9.4 once published by the vendor; the input data does not include an exact fixed version, so treat the patch as not independently confirmed and verify the fixed build against the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/link-whisper/vulnerability/wordpress-link-whisper-free-plugin-0-9-4-reflected-cross-site-scripting-xss-vulnerability) before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all WordPress instances running Link Whisper Free; identify versions 0.9.4 and earlier; review access logs and admin login activity for suspicious patterns or unauthorized access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Link Whisper Free
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today