WordPress Link Whisper Free plugin <= 0.9.0 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by mikemyers in WordPress Plugin Link Whisper Free versions = 0.9.0...

CVE-2025-41270

creationtimestamp| type| source ---|---|--- 2026-05-29 13:06:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmym3ipin42t...

CVE-2025-41274

creationtimestamp| type| source ---|---|--- 2026-05-29 12:56:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmylkjefwc2i...

CVE-2025-41271

creationtimestamp| type| source ---|---|--- 2026-05-29 12:55:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmylhohk3x2r...

CVE-2026-49200

creationtimestamp| type| source ---|---|--- 2026-05-29 12:10:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmyiwz2a772e 2026-06-03 18:30:06+00:00| seen| https://t.me/truesecator/8277...

CVE-2026-6075

creationtimestamp| type| source ---|---|--- 2026-05-29 12:00:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmyif3umoo2k 2026-05-31 01:00:51+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mn4ehxsukp2j...

CVE-2026-7056

creationtimestamp| type| source ---|---|--- 2026-05-29 11:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mmyfgas2ct2g...

CVE-2026-45800

creationtimestamp| type| source ---|---|--- 2026-05-29 11:02:12+00:00| seen| https://bsky.app/profile/keiwork35.bsky.social/post/3mmyf5heqfc2n...

CVE-2026-49322

creationtimestamp| type| source ---|---|--- 2026-05-29 10:04:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmybvldw3f2k...

CVE-2026-9714

creationtimestamp| type| source ---|---|--- 2026-05-29 09:43:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmyapv6qjt2m...

CVE-2026-6275

creationtimestamp| type| source ---|---|--- 2026-05-29 09:17:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmy7d45tjm2e...

CVE-2025-11262

The Link Whisper Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the userid parameter in all versions up to, and including, 0.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-49216

creationtimestamp| type| source ---|---|--- 2026-05-29 07:32:44+00:00| seen| https://bsky.app/profile/symfony.com/post/3mmxzgupjrn2c...

CVE-2026-49211

creationtimestamp| type| source ---|---|--- 2026-05-29 07:32:34+00:00| seen| https://bsky.app/profile/symfony.com/post/3mmxzgmdwar2x...

CVE-2025-11262 Link Whisper Free <= 0.9.0 - Unauthenticated Stored Cross-Site Scripting

The Link Whisper Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the userid parameter in all versions up to, and including, 0.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2025-11262

The CVE-2025-11262 entry concerns WordPress “Link Whisper Free” plugin vulnerable to stored XSS via the user_id parameter in all versions up to and including 0.9.0. Insufficient input sanitization and output escaping enables unauthenticated attackers to inject scripts in pages that execute for us...

EUVD-2025-209983

The Link Whisper Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the userid parameter in all versions up to, and including, 0.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2025-11262

The Link Whisper Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the userid parameter in all versions up to, and including, 0.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2025-11262 Link Whisper Free <= 0.9.0 - Unauthenticated Stored Cross-Site Scripting

The Link Whisper Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the userid parameter in all versions up to, and including, 0.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2025-66391

creationtimestamp| type| source ---|---|--- 2026-05-29 06:28:20+00:00| seen| https://gist.github.com/mandeepsohal/be8266041311404f8c6fc4f5f2c38230...