CVE-2026-14601: Unknown Link Whisper Free

Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days.

The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks.

Affected products

• Unknown Link Whisper Free: before 0.9.7 (fixed in 0.9.7)

Published 2026-08-21. Last modified 2026-08-26.