CVE-2024-27992: 
WordPress vulnerability analysis and mitigation

A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in Link Whisper Link Whisper Free plugin versions through 0.6.8. The vulnerability was discovered and reported by Dimas Maulana on January 19, 2024, and was publicly disclosed on March 15, 2024. This security issue affects WordPress installations using the Link Whisper Free plugin (Patchstack).

The vulnerability is classified as a Cross-Site Scripting (XSS) issue, specifically involving improper neutralization of input during web page generation. It has been assigned a CVSS v3.1 base score of 7.1 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vulnerability is tracked as CWE-79, which relates to improper neutralization of input during web page generation (NVD).

The vulnerability could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into the website which will be executed when guests visit the site (Patchstack).

The vulnerability can be exploited by unauthenticated attackers, making it particularly concerning. No special privileges are required to exploit this vulnerability (Patchstack).

Users are advised to update to Link Whisper Free version 0.6.9 or later, which contains the fix for this vulnerability. Additionally, Patchstack has issued a virtual patch to mitigate this issue by blocking any attacks until users can update to a fixed version (Patchstack).