Linkwhisper vulnerabilities
Published CVEs affecting Linkwhisper products: 6 record(s), with severity, exploitation and fixes.
CVE-2026-109688
Critical · 9.3
CWE-89 Oct 15, 2026
WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
CVE-2026-109686
Critical · 9.8
CWE-502 Oct 15, 2026
WordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
CVE-2026-109685
High · 7.1
CWE-79 Oct 15, 2026
WordPress Link Whisper Free plugin <= 0.9.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through 0.9.7.
CVE-2026-109687
High · 7.6
CWE-89 Oct 13, 2026
WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
CVE-2026-57353
Medium · 6.5
CWE-862 Jul 2, 2026
WordPress Link Whisper Premium plugin <= 2.9.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in Link Whisper Premium <= 2.9.0 versions.
CVE-2026-1900
Medium · 6.5
CWE-306 Apr 7, 2026
Link Whisper Free < 0.9.1 - Unauthenticated Settings and User Meta Update
The Link Whisper Free WordPress plugin before 0.9.1 has a publicly accessible REST endpoint that allows unauthenticated settings updates.