Is CVE-2026-57682 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57682 being exploited in the wild.

How severe is CVE-2026-57682?

High severity, with a CVSS score of 7.1, published 2 July 2026.

Which products and versions are affected?

QuantumCloud Simple Link Directory <= 15.0.5.

Is there a fix for CVE-2026-57682?

A patch was published on 2026-06-30: Version 15.0.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57682 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-57682?

Check whether you run QuantumCloud Simple Link Directory at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57682: QuantumCloud Simple Link Directory unauthenticated XSS

Q: Is there a fix for CVE-2026-57682?

A patch was published on 2026-06-30: Version 15.0.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-57682 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-57682?

Check whether you run QuantumCloud Simple Link Directory at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57682 · Severity: high · CVSS 7.1 · Published 2026-07-02

Simple Link Directory is a WordPress plugin used to create and manage link directories on websites. A security flaw allows unauthenticated attackers to inject malicious scripts into the site, which could lead to unauthorized redirects, advertisement injection, or the theft of user session information when a victim visits a compromised page. This vulnerability can be exploited without a password, though it typically requires a user to click a link or visit a specific page.

Technologies: QuantumCloud Simple Link Directory. Vendors: QuantumCloud.

Quick answers

Is CVE-2026-57682 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57682 being exploited in the wild.
How severe is CVE-2026-57682?: High severity, with a CVSS score of 7.1, published 2 July 2026.
Which products and versions are affected?: QuantumCloud Simple Link Directory <= 15.0.5.
Is there a fix for CVE-2026-57682?: A patch was published on 2026-06-30: Version 15.0.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57682 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-57682?: Check whether you run QuantumCloud Simple Link Directory at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reflected Cross-Site Scripting (XSS) vulnerability exists in the QuantumCloud Simple Link Directory plugin for WordPress due to improper neutralization of user-supplied input during web page generation (CWE-79). The flaw allows an unauthenticated remote attacker to inject arbitrary JavaScript or HTML payloads. Exploitation requires a victim to interact with a specially crafted link or page (User Interaction: Required). Successful exploitation can lead to session hijacking, unauthorized redirection, or defacement of the site as viewed by the victim. The vulnerability is addressed in version 15.0.6.

Affected products

QuantumCloud Simple Link Directory <= 15.0.5

Timeline

2026-05-02: other: Reported by researcher dutafi
2026-06-30: advisory: Patchstack advisory published
2026-07-02: disclosed: NVD publication date
2026-06-30: patched: Version 15.0.6 released

References

https://patchstack.com/database/wordpress/plugin/qc-simple-link-directory/vulnerability/wordpress-simple-link-directory-plugin-15-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.