Executive brief
Simple Link Directory is a WordPress plugin used to create and manage link directories, resource pages, and bookmark collections. A security flaw allows users with 'contributor' level access to inject malicious scripts into the directory's embed templates. If a site visitor or administrator views the affected page, these scripts could execute in their browser, potentially leading to unauthorized actions or data theft.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Simple Link Directory through version 9.0.4. The issue stems from the embedder template echoing shortcode attributes directly into HTML data attributes without proper sanitization or escaping. An attacker with contributor-level privileges can craft a malicious shortcode attribute containing an event handler (e.g., onmouseover). When a victim views the page where the shortcode is rendered, the injected script executes in the context of their browser session. This is tracked as CWE-79.
Affected products
- QuantumCloud Simple Link Directory through 9.0.4
Timeline
- 2026-06-10: disclosed
- 2026-06-10: advisory