CVE-2025-11262: Link Whisper Free WordPress XSS Flaw

CVE-2025-11262 Overview

CVE-2025-11262 is a Stored Cross-Site Scripting (XSS) vulnerability in the Link Whisper Free plugin for WordPress. The flaw affects all versions up to and including 0.9.0. It originates from insufficient input sanitization and output escaping on the user_id parameter. Unauthenticated attackers can inject arbitrary JavaScript that executes in the browser of any visitor who loads an affected page. The vulnerability is classified under CWE-79.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript into WordPress pages, enabling session theft, administrative account takeover, and arbitrary actions on behalf of authenticated site users.

Affected Products

Link Whisper Free plugin for WordPress
All versions through 0.9.0
WordPress sites with the vulnerable plugin installed and active

Discovery Timeline

2026-05-29 - CVE-2025-11262 published to NVD
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2025-11262

Vulnerability Analysis

The vulnerability resides in the Link Whisper Free plugin's handling of the user_id parameter. The plugin accepts the parameter value and renders it back into administrative or front-end output without applying proper sanitization or escaping routines. Because the injected content is persisted, the payload executes each time a user loads the affected page. The relevant code path is referenced in the plugin source at core/Wpil/Settings.php line 883, per the WordPress Plugin Code Review.

Root Cause

The plugin fails to sanitize user-controlled input before storage and does not escape the value during output rendering. WordPress provides functions such as sanitize_text_field() for input handling and esc_html() or esc_attr() for output, but neither is applied to the user_id parameter. This omission allows raw HTML and JavaScript to be stored and later returned to the browser.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request that supplies a malicious payload in the user_id parameter. The payload is persisted in the WordPress database. When an administrator or other user views the affected page, the script executes in their authenticated browser session. Possible follow-on actions include cookie theft, forced administrative actions through the WordPress REST API, plugin installation, or redirection to attacker-controlled domains. Additional analysis is available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-11262

Indicators of Compromise

Unexpected <script>, onerror=, or onload= strings stored in WordPress options or plugin-specific database tables
Outbound browser requests from administrative sessions to unknown domains immediately after loading Link Whisper pages
Newly created WordPress administrator accounts or modified user roles without a corresponding audit trail
HTTP POST requests containing encoded JavaScript payloads in the user_id parameter targeting Link Whisper endpoints

Detection Strategies

Inspect web server access logs for requests to Link Whisper endpoints with suspicious user_id values containing HTML or script characters
Query the WordPress database for plugin-managed records and search stored fields for tags such as <script, javascript:, or event handler attributes
Compare the installed Link Whisper Free version against 0.9.0 to identify vulnerable hosts at scale

Monitoring Recommendations

Enable WordPress audit logging to track changes to user accounts, plugins, and options tables
Forward web server and WordPress application logs to a centralized analytics platform for correlation and retention
Alert on administrator browser sessions issuing unusual REST API calls shortly after rendering plugin admin pages

How to Mitigate CVE-2025-11262

Immediate Actions Required

Deactivate and remove the Link Whisper Free plugin until a patched version is confirmed installed
Audit all WordPress administrator accounts and reset credentials for any account that accessed plugin pages while the vulnerable version was active
Review stored plugin data and remove any records containing script tags or HTML event handlers
Apply a Web Application Firewall (WAF) rule blocking requests with script payloads in the user_id parameter

Patch Information

At the time of publication, no fixed version is referenced in the NVD entry. Monitor the Link Whisper Developer Info page for an updated release beyond 0.9.0 and apply it as soon as it becomes available. Confirm the update through the WordPress plugin manager and verify the version string post-installation.

Workarounds

Restrict access to WordPress administrative endpoints by IP allowlist at the web server or WAF layer
Deploy a WAF signature that blocks HTML tags and JavaScript event handlers in plugin parameters
Enforce Content Security Policy (CSP) headers that disallow inline scripts on WordPress administrative pages

bash

# Example nginx rule to block script payloads in the user_id parameter
if ($args ~* "user_id=[^&]*(<script|javascript:|onerror=|onload=)") {
    return 403;
}