# CVE-2026-57682: QuantumCloud Simple Link Directory unauthenticated XSS

Source: https://junglewise.ai/threats/cve-2026-57682-quantumcloud-simple-link-directory-unauthenticated-xss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-02. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-57682 · Severity: high · CVSS 7.1 · Published 2026-07-02

Simple Link Directory is a WordPress plugin used to create and manage link directories on websites. A security flaw allows unauthenticated attackers to inject malicious scripts into the site, which could lead to unauthorized redirects, advertisement injection, or the theft of user session information when a victim visits a compromised page. This vulnerability can be exploited without a password, though it typically requires a user to click a link or visit a specific page.

Technologies: [QuantumCloud Simple Link Directory](https://junglewise.ai/threats/technologies/simple-link-directory). Vendors: [QuantumCloud](https://junglewise.ai/threats/vendors/quantumcloud).

## Quick answers

**Is CVE-2026-57682 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57682 being exploited in the wild.

**How severe is CVE-2026-57682?** High severity, with a CVSS score of 7.1, published 2 July 2026.

**Which products and versions are affected?** QuantumCloud Simple Link Directory <= 15.0.5.

**Is there a fix for CVE-2026-57682?** A patch was published on 2026-06-30: Version 15.0.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57682 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-57682?** Check whether you run QuantumCloud Simple Link Directory at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A reflected Cross-Site Scripting (XSS) vulnerability exists in the QuantumCloud Simple Link Directory plugin for WordPress due to improper neutralization of user-supplied input during web page generation (CWE-79). The flaw allows an unauthenticated remote attacker to inject arbitrary JavaScript or HTML payloads. Exploitation requires a victim to interact with a specially crafted link or page (User Interaction: Required). Successful exploitation can lead to session hijacking, unauthorized redirection, or defacement of the site as viewed by the victim. The vulnerability is addressed in version 15.0.6.

## Affected products

- QuantumCloud Simple Link Directory <= 15.0.5

## Timeline

- 2026-05-02: other: Reported by researcher dutafi
- 2026-06-30: advisory: Patchstack advisory published
- 2026-07-02: disclosed: NVD publication date
- 2026-06-30: patched: Version 15.0.6 released

## References

- [https://patchstack.com/database/wordpress/plugin/qc-simple-link-directory/vulnerability/wordpress-simple-link-directory-plugin-15-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/qc-simple-link-directory/vulnerability/wordpress-simple-link-directory-plugin-15-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve)

## Related threats

- [QuantumCloud Simple Link Directory Stored XSS in embed shortcode](https://junglewise.ai/threats/cve-2026-53742-quantumcloud-simple-link-directory-stored-xss-in-embed-shortcode)
- [QuantumCloud Simple Link Directory Stored XSS in sld_no_results_found](https://junglewise.ai/threats/cve-2026-53741-quantumcloud-simple-link-directory-stored-xss-in-sld-no-results)