CVE-2026-53741: medium-severity vulnerability in quantumcloud Simple Link Directory
Simple Link Directory through 9.0.4 Stored XSS via sld_no_results_found Option
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.1epss 0.1%
Simple Link Directory through 9.0.4 interpolates the sld_no_results_found option into a JavaScript string literal without encoding. Because sanitize_text_field leaves quotes intact, a stored payload breaks out of the string and runs script for every page visitor.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Affected products
quantumcloud · Simple Link DirectoryRelated CVEs — quantumcloud Simple Link Directory
In the same product, most dangerous first.
CVE-2025-49901CRITICALWordPress Simple Link Directory plugin < 14.8.1 - Broken Authentication vulnerabilityEPSS 0.7%CVE-2024-12417MEDIUMSimple Link Directory <= 8.4.5 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 0.5%CVE-2025-32296MEDIUMWordPress Simple Link Directory Pro plugin < 14.8.1 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-32297HIGHWordPress Simple Link Directory Pro plugin < 14.8.1 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-48297HIGHWordPress Simple Link Directory < 14.8.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-7209MEDIUMSimple Link Directory <= 8.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%