Executive brief
Simple Link Directory is a WordPress plugin used to create and manage web directories and resource lists. A security flaw allows an attacker with basic account access to inject malicious scripts into the plugin's settings. These scripts will then execute in the browsers of any visitor who views the directory, potentially leading to unauthorized actions or data theft.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Simple Link Directory through version 9.0.4. The root cause is the improper interpolation of the 'sld_no_results_found' configuration option into a JavaScript string literal without adequate encoding. While the plugin uses 'sanitize_text_field', this function does not strip or escape quotes, allowing an attacker with low-level privileges to break out of the string literal and execute arbitrary JavaScript. The payload is stored in the database and executes whenever a user visits a page where the directory is rendered. This can lead to session hijacking or unauthorized administrative actions if a site administrator views the affected page.
Affected products
- QuantumCloud Simple Link Directory <= 9.0.4
Timeline
- 2026-06-10: disclosed
- 2026-06-10: advisory