CVE-2025-67927

Overview

CVE-2025-67927 is a reflected cross-site scripting (XSS) vulnerability in the Link Whisper Free WordPress plugin, affecting versions through 0.8.8. The root cause is improper neutralization of user-supplied input during web page generation, allowing an attacker to inject arbitrary HTML and JavaScript into a page [1].

Exploitation

To exploit this vulnerability, an attacker must trick a privileged user (such as an administrator) into clicking a crafted link or visiting a specially prepared page that triggers the reflected XSS. This interaction requirement lowers the attack complexity but does not require authentication from the attacker's side—only a valid user action on the target site [1].

Impact

Successful exploitation could allow the attacker to execute arbitrary scripts in the context of the victim's browser. This can lead to session hijacking, redirection to malicious sites, display of advertisements, or other harmful actions that affect site visitors [1].

Mitigation

The vulnerability has been patched in version 0.8.9 of Link Whisper Free. Users are strongly advised to update immediately. Patchstack also provides a mitigation rule to block attacks until the update is applied [1].