CVE-2026-53741mediumCWE-79

CVE-2026-53741: falha de média gravidade em quantumcloud Simple Link Directory

Simple Link Directory through 9.0.4 Stored XSS via sld_no_results_found Option

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Simple Link Directory

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.1epss 0.1%
Simple Link Directory through 9.0.4 interpolates the sld_no_results_found option into a JavaScript string literal without encoding. Because sanitize_text_field leaves quotes intact, a stored payload breaks out of the string and runs script for every page visitor.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Produtos afetados
quantumcloud · Simple Link Directory
CVEs relacionadas — quantumcloud Simple Link Directory

No mesmo produto, das mais perigosas para as menos.

CVE-2025-49901CRITICALWordPress Simple Link Directory plugin < 14.8.1 - Broken Authentication vulnerabilityEPSS 0.7%CVE-2024-12417MEDIUMSimple Link Directory <= 8.4.5 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 0.5%CVE-2025-32296MEDIUMWordPress Simple Link Directory Pro plugin < 14.8.1 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-32297HIGHWordPress Simple Link Directory Pro plugin < 14.8.1 - SQL Injection VulnerabilityEPSS 0.3%CVE-2025-48297HIGHWordPress Simple Link Directory < 14.8.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-7209MEDIUMSimple Link Directory <= 8.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%