CVE-2026-57333 is an unauthenticated Cross-Site Scripting (CWE-79) vulnerability in Spencer Haws' Link Whisper Free plugin versions up to 0.9.4. The flaw arises from improper neutralization of input during web page generation, enabling attackers to inject malicious scripts. The vulnerability has a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and partial impact on confidentiality, integrity, and availability. The product is a cloud-hosted service, and a patch is available though specific patch details are not provided in the advisory.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected web application, potentially resulting in partial confidentiality, integrity, and availability impacts. Since the vulnerability is unauthenticated and remotely exploitable, it poses a significant risk to users interacting with the affected service.

The vendor manages remediation for this cloud-hosted service and has made a patch available. Users should verify with the vendor advisory for the latest patch status and apply updates as recommended. Since the service is cloud-hosted, the vendor likely applies patches server-side, reducing the need for user intervention.