The Link Whisper Free plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) via the user_id parameter in all versions up to and including 0.9.0. This vulnerability is due to improper neutralization of input during web page generation, specifically insufficient input sanitization and output escaping. An unauthenticated attacker can exploit this flaw to inject malicious scripts that execute in the context of users visiting the injected pages. The vulnerability has a CVSS 3.1 base score of 7.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, and low confidentiality and integrity impacts.

Successful exploitation allows an unauthenticated attacker to perform stored cross-site scripting attacks, potentially leading to the execution of arbitrary scripts in the context of users accessing the affected pages. This can result in information disclosure and integrity impacts as indicated by the CVSS vector. There is no indication of availability impact. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is documented, users should monitor the vendor's communications for updates. Until a patch is available, consider restricting access to affected plugin functionality or disabling the plugin if feasible to reduce exposure.