CVE-2025-67927 describes a reflected cross-site scripting vulnerability in the Spencer Haws Link Whisper Free plugin (version <= 0.8.8). The vulnerability is caused by improper neutralization of input during web page generation, which enables an attacker to inject malicious scripts that execute when a user interacts with a crafted link or page. The vulnerability has a CVSS v3.1 score of 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. The product is cloud-hosted, and a patch is available to remediate the issue.

Successful exploitation of this reflected XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to theft of user data, session hijacking, or other malicious actions. The CVSS score indicates limited but notable impacts on confidentiality, integrity, and availability. No known exploits are currently reported in the wild.

Since the product is a cloud service and a patch is available, remediation is managed by the vendor. Users should verify that the vendor has applied the official fix to their environment. Patch status is confirmed as available; therefore, applying the vendor's update or ensuring the cloud service is up to date is the recommended mitigation. No additional user action is required beyond confirming the patch application.