CVE-2026-57682
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The Simple Link Directory plugin version 15.0.5 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without requiring authentication.
Risk Assessment
The risk involves the execution of arbitrary JavaScript code in browsers of site visitors, potentially leading to session theft, redirects, or data theft.
Recommendation
Immediately update the Simple Link Directory plugin to the latest available version that fixes this vulnerability. If an update is not possible, consider temporarily disabling the plugin.
Other vulnerabilities in Simple Link Directory
See all- CVE-2026-53742Medium
Simple Link Directory through 9.0.4 echoes embed shortcode attributes into HTML data attributes without escaping in the embedder template. Attackers with contributor access can inject an event handler executing in a viewer's browser.
- CVE-2026-53741Medium
Simple Link Directory through 9.0.4 interpolates the sld_no_results_found option into a JavaScript string literal without encoding. Because sanitize_text_field leaves quotes intact, a stored payload breaks out of the string and runs script for every page visitor.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Simple Link Directory <= 15.0.5 versions.