The vulnerability CVE-2026-22357 involves improper neutralization of input in the Spencer Haws Link Whisper Free plugin, leading to reflected Cross-site Scripting (XSS). This affects versions up to and including 0.9.2. The vulnerability allows an attacker to inject malicious scripts via crafted input that is reflected in web pages generated by the plugin. The CVSS 3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability. The product is cloud-hosted, and a patch is available to remediate the issue.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to unauthorized disclosure of information, modification of data, or disruption of service. The CVSS vector indicates impacts on confidentiality, integrity, and availability. However, no known exploits are reported in the wild.

A patch is available for this vulnerability. Since the product is a cloud service, the vendor manages remediation server-side. Users should verify with the vendor advisory that the patch has been applied or that the service is updated to mitigate this vulnerability. No additional user action is required beyond ensuring the service is up to date.