This vulnerability in Link Whisper Free (<= 0.9.2) is a reflected cross-site scripting flaw caused by improper input neutralization during web page generation. An attacker can craft malicious input that is reflected in the web page without proper sanitization, enabling script execution in the victim's browser. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability. The vulnerability is confirmed published and a patch is available.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to partial compromise of confidentiality, integrity, and availability of user data or session. The reflected XSS can be used to steal cookies, perform actions on behalf of the user, or deliver malicious payloads. However, no known exploits are currently reported in the wild.

A patch is available for this vulnerability. Users of Link Whisper Free should update to the fixed version as soon as possible to remediate the reflected XSS issue. Since this is not a cloud service, remediation depends on applying the vendor's patch. Monitor the vendor advisory for the official patch release and instructions.