Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-07-21
Link Whisper - Cross-Site Scripting (XSS) (CVE-2025-11262)
The Link Whisper Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 0.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Link Whisper
CVE-2025-11262
Risk Score
Threat Entry
Updated 2026-06-17
Link Whisper - Security Vulnerability (CVE-2026-1900)
The Link Whisper Free WordPress plugin before 0.9.1 has a publicly accessible REST endpoint that allows unauthenticated settings updates.
PLUGIN
Link Whisper
CVE-2026-1900
Risk Score
Threat Entry
Updated 2026-06-17
Link Whisper - Cross-Site Scripting (XSS) (CVE-2026-22357)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spencer Haws Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through
PLUGIN
Link Whisper
CVE-2026-22357
Risk Score
Threat Entry
Updated 2026-06-17
Link Whisper - Cross-Site Scripting (XSS) (CVE-2025-67927)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spencer Haws Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through
PLUGIN
Link Whisper
CVE-2025-67927
Risk Score
Threat Entry
Updated 2026-06-17
Link Whisper - Cross-Site Scripting (XSS) (CVE-2025-11263)
The Link Whisper Free plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the type parameter in all versions up to, and including, 0.8.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Link Whisper
CVE-2025-11263
Risk Score
Threat Entry
Updated 2026-06-17
Link Whisper - Broken Access Control (CVE-2025-62970)
Missing Authorization vulnerability in Spencer Haws Link Whisper Free link-whisper allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Link Whisper Free: from n/a through
PLUGIN
Link Whisper
CVE-2025-62970
Risk Score
Threat Entry
Updated 2026-06-17
Link Whisper - Information Disclosure (CVE-2025-22306)
Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Spencer Haws Link Whisper Free link-whisper.This issue affects Link Whisper Free: from n/a through
PLUGIN
Link Whisper
CVE-2025-22306
Risk Score
Threat Entry
Updated 2026-06-17
Link Whisper - Broken Access Control (CVE-2023-32506)
Missing Authorization vulnerability in Link Whisper Link Whisper Free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Link Whisper Free: from n/a through 0.6.3.
PLUGIN
Link Whisper
CVE-2023-32506
Risk Score
Threat Entry
Updated 2026-06-17
Link Whisper - PHP Object Injection (CVE-2024-2693)
The Link Whisper Free plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.7.1 via deserialization of untrusted input of the 'mfn-page-items' post meta value. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute…
PLUGIN
Link Whisper
CVE-2024-2693
Risk Score