medium5.4
CVE-2026-53742
Simple Link Directory through 9.0.4 echoes embed shortcode attributes into HTML data attributes without escaping in the embedder template.
Impact
Simple Link Directory through 9.0.4 echoes embed shortcode attributes into HTML data attributes without escaping in the embedder template. Attackers with contributor access can craft a shortcode attribute that injects an event handler executing in a viewer's browser.
Affected products
| Product | Affected versions |
|---|---|
| Simple Link Directory | through 9.0.4 |
Versions were read from the advisory text. No structured product data has been published for this record yet.