# CVE-2026-53741: QuantumCloud Simple Link Directory Stored XSS in sld_no_results_found

Source: https://junglewise.ai/threats/cve-2026-53741-quantumcloud-simple-link-directory-stored-xss-in-sld-no-results  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-53741 · Severity: medium · CVSS 5.4 · Published 2026-06-10

Simple Link Directory is a WordPress plugin used to create and manage web directories and resource lists. A security flaw allows an attacker with basic account access to inject malicious scripts into the plugin's settings. These scripts will then execute in the browsers of any visitor who views the directory, potentially leading to unauthorized actions or data theft.

Technologies: [QuantumCloud Simple Link Directory](https://junglewise.ai/threats/technologies/simple-link-directory). Vendors: [QuantumCloud](https://junglewise.ai/threats/vendors/quantumcloud).

## Quick answers

**Is CVE-2026-53741 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53741 being exploited in the wild.

**How severe is CVE-2026-53741?** Medium severity, with a CVSS score of 5.4, published 10 June 2026.

**Which products and versions are affected?** QuantumCloud Simple Link Directory <= 9.0.4.

**Is there a fix for CVE-2026-53741?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-53741 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-53741?** Check whether you run QuantumCloud Simple Link Directory at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in Simple Link Directory through version 9.0.4. The root cause is the improper interpolation of the 'sld_no_results_found' configuration option into a JavaScript string literal without adequate encoding. While the plugin uses 'sanitize_text_field', this function does not strip or escape quotes, allowing an attacker with low-level privileges to break out of the string literal and execute arbitrary JavaScript. The payload is stored in the database and executes whenever a user visits a page where the directory is rendered. This can lead to session hijacking or unauthorized administrative actions if a site administrator views the affected page.

## Affected products

- QuantumCloud Simple Link Directory <= 9.0.4

## Timeline

- 2026-06-10: disclosed
- 2026-06-10: advisory

## References

- [https://wordpress.org/plugins/simple-link-directory/](https://wordpress.org/plugins/simple-link-directory/)
- [https://www.vulncheck.com/advisories/simple-link-directory-through-stored-xss-via-sld-no-results-found-option](https://www.vulncheck.com/advisories/simple-link-directory-through-stored-xss-via-sld-no-results-found-option)

## Related threats

- [QuantumCloud Simple Link Directory unauthenticated XSS](https://junglewise.ai/threats/cve-2026-57682-quantumcloud-simple-link-directory-unauthenticated-xss)
- [QuantumCloud Simple Link Directory Stored XSS in embed shortcode](https://junglewise.ai/threats/cve-2026-53742-quantumcloud-simple-link-directory-stored-xss-in-embed-shortcode)