CVE-2025-11262

Vulnerability

The Link Whisper Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 0.9.0. The vulnerability resides in the user_id parameter, which is insufficiently sanitized and escaped before output. This flaw occurs in the context provided by the plugin's core component at /core/Wpil/Settings.php line 883 [2]. An attacker can inject arbitrary web scripts that are stored and executed whenever a user accesses the affected page. No special configuration is required; the vulnerable code path is reachable in default installations.

Exploitation

An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request containing malicious JavaScript or HTML in the user_id parameter. No authentication or elevated privileges are needed, and there is no requirement for user interaction during the injection phase. The injected payload is stored in the database and triggers when any authenticated user (including administrators) visits the page where the payload is rendered. The attack does not require a race condition or any write access beyond the HTTP request itself.

Impact

Successful exploitation allows the attacker to execute arbitrary web scripts in the context of the victim's browser session. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. The impact is a full compromise of confidentiality and integrity within the scope of the affected WordPress admin or frontend pages, depending on where the injected script runs. The attacker gains no direct server-side access but can leverage the victim's privileges for further attacks.

Mitigation

The vendor has not yet released a patched version as of the publication date. As of version 0.9.0, the plugin remains vulnerable. Users should monitor the plugin's changelog at [1] for a security update. If no fix is available, a temporary workaround is to disable the plugin until a patch is applied. There is no indication that this CVE is listed in the KEV catalog.