CVE-2026-14601

Name of the Vulnerable Software and Affected Versions Link Whisper Free WordPress plugin versions prior to 0.9.7

Description Authenticated users with the Editor role or higher can perform SQL injection attacks because the plugin fails to properly sanitize and escape the domain parameter before incorporating it into a SQL query. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to or manipulation of the database.

Recommendations Update the plugin to version 0.9.7 or later. Avoid using the domain parameter until the update is applied.