Link Whisper — Vulnerabilities & Security Advisories 4

Link Whisper is a WordPress plugin designed to automate internal linking between posts to improve SEO. Historically, it has been vulnerable to multiple security issues including stored cross-site scripting (XSS) and remote code execution (RCE) due to insufficient input sanitization and improper access controls. The plugin has also faced privilege escalation vulnerabilities that allowed lower-privileged users to perform unauthorized actions. With four CVEs recorded, these issues have enabled attackers to inject malicious scripts, execute arbitrary code on vulnerable sites, and potentially compromise entire WordPress installations. No major public incidents have been widely reported, but the consistent pattern of vulnerabilities highlights ongoing security concerns in its development practices.