Simple Link Directory
Approved changes feed: RSS · Atom
cpe:2.3:a:quantumcloud:simple_link_directory:*:*:*:*:*:wordpress:*:*
part: a version: * update: *
| Vendor | Quantumcloud (fc50f2d3-47a6-505c-9932-77dd419877b0) |
|---|---|
| Product | Simple Link Directory (750e1039-9c10-595c-80db-3402096b7c38) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-53742 |
vulnerable | 2026-07-29 01:00:27.224919 |
Simple Link Directory through 9.0.4 Stored XSS via Embed Shortcode Attributes
MEDIUM (5.4)
Simple Link Directory through 9.0.4 echoes embed shortcode attributes into HTML data attributes without escaping in the embedder template. Attackers with contributor access can craft a shortcode attribute that injects an event handler executing in a viewer's browser.
Published: 2026-06-10T20:39:46.549Z
Updated: 2026-06-11T13:58:44.233Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-53741 |
vulnerable | 2026-07-29 01:00:27.224547 |
Simple Link Directory through 9.0.4 Stored XSS via sld_no_results_found Option
MEDIUM (5.4)
Simple Link Directory through 9.0.4 interpolates the sld_no_results_found option into a JavaScript string literal without encoding. Because sanitize_text_field leaves quotes intact, a stored payload breaks out of the string and runs script for every page visitor.
Published: 2026-06-10T20:39:45.823Z
Updated: 2026-06-11T14:41:11.419Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-0760 |
vulnerable | 2026-06-08 05:39:10.774243 |
Simple Link Directory < 7.7.2 - Unauthenticated SQL injection
The Simple Link Directory WordPress plugin before 7.7.2 does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection
Published: 2022-03-21T18:56:05.000Z
Updated: 2024-08-02T23:40:03.773Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-13463 |
vulnerable | 2026-06-08 05:12:42.259746 |
Details available
An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress allows remote attackers to inject arbitrary web script or HTML, because esc_html is not called for the "echo get_the_title()" or "echo $term->name" statement.
Published: 2020-03-20T20:40:01.000Z
Updated: 2024-08-04T23:57:37.897Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.