CVE-2026-109685: WordPress Link Whisper Free plugin <= 0.9.7 - Cross Site Scripting (XSS) vulnerability

Q: What access does an attacker need to exploit this issue?

The attack can be performed remotely without privileges, but it requires user interaction. Successful exploitation involves getting a user to interact with a maliciously crafted request or page content.

Q: Which installations should be treated as affected?

Link Whisper Free versions through 0.9.7 are identified as affected. The provided information does not specify a fixed version.

Published Oct 15, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through 0.9.7.

Affected Software

1 affected component

Link Whisper Link Whisper Free<=0.9.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/link-whisper to a version that resolves this vulnerability.
Fixed in 0.9.8

Event History

Oct 15, 2026

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attack can be performed remotely without privileges, but it requires user interaction. Successful exploitation involves getting a user to interact with a maliciously crafted request or page content.

Which installations should be treated as affected?