CVE-2025-11262

HIGH EXPLOITED LAB

Link Whisper Free <= 0.9.0 - Unauthenticated Stored Cross-Site Scripting

Title source: cna
STIX 2.1

Exploitation Summary

CVE-2025-11262 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including rootdirective-sec.

AI-analyzed exploit summary This repository contains a functional PoC for CVE-2025-11262, a Stored XSS vulnerability in Link Whisper Free AI authentication REST endpoint. The PoC sends a crafted payload to a local WordPress lab environment, demonstrating the vulnerability in version 0.9.0 and confirming the fix in version 0.9.1.

Description

The Link Whisper Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 0.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Exploits (1)

github WORKING POC
by rootdirective-sec · pythonclient-side
https://github.com/rootdirective-sec/CVE-2025-11262-Lab

This repository contains a functional PoC for CVE-2025-11262, a Stored XSS vulnerability in Link Whisper Free AI authentication REST endpoint. The PoC sends a crafted payload to a local WordPress lab environment, demonstrating the vulnerability in version 0.9.0 and confirming the fix in version 0.9.1.

Classification
Working Poc 95%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Link Whisper Free (WordPress plugin) versions 0.9.0 and below
No auth needed
Prerequisites: Local WordPress lab environment with Link Whisper Free plugin version 0.9.0 installed
devstral-2 · analyzed Jun 09, 2026 Full analysis →

Scores

CVSS v3 7.2
EPSS 0.0011
EPSS Percentile 28.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Lab Environment

COMMUNITY
Community Lab
docker pull wordpress:6.6.2-php8.2-apache

Details

VulnCheck KEV 2026-05-29
CWE
CWE-79
Status published
Products (1)
linkwhspr/Link Whisper Free < 0.9.0
Published May 29, 2026
Tracked Since May 29, 2026