Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2026-14601

Link Whisper < 0.9.7 - Editor+ SQL Injection via domain Parameter

The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Linkwhisper Wordpress
Products
Link Whisper Free Wordpress
CVE-2025-11262

Link Whisper Free <= 0.9.0 - Unauthenticated Stored Cross-Site Scripting

The Link Whisper Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 0.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Linkwhisper Wordpress
Products
Link Whisper Free Wordpress
CVE-2023-47852

WordPress Link Whisper Free Plugin <= 0.6.5 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper Link Whisper Free.This issue affects Link Whisper Free: from n/a through 0.6.5.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Linkwhisper
Products
Link Whisper Free
CVE-2025-11263

Link Whisper Free <= 0.8.8 - Reflected Cross-Site Scripting

The Link Whisper Free plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the type parameter in all versions up to, and including, 0.8.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Linkwhisper Wordpress
Products
Link Whisper Free Wordpress
CVE-2024-2693

Link Whisper Free <= 0.7.1 - Authenticated (Contributor+) PHP Object Injection

The Link Whisper Free plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.7.1 via deserialization of untrusted input of the 'mfn-page-items' post meta value. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Linkwhisper
Products
Link Whisper Free