Simple Link Directory CVE-2026-57682

Exploitation requires that the vulnerable Simple Link Directory plugin (<= 15.0.5) be installed and its affected front-end feature (submission, search, or listing rendering) be reachable by anonymous users, and it requires user interaction (UI:R) - a victim must open an attacker-crafted link or view attacker-supplied directory content for the payload to fire. No authentication is needed (PR:N), so any unauthenticated attacker can plant or deliver the payload. The primary limiting factors are the need to lure a victim into interacting and the client-side-only impact (Low C/I/A); the most valuable outcomes depend on a privileged user (e.g., an admin) being the one who triggers the script. The exact injectable parameter and whether the XSS is reflected or stored are not specified in the provided data.

The signals are moderate and largely consistent. CVSS is 7.1 (High) driven by network reach and no privileges (AV:N/AC:L/PR:N) plus a scope change (S:C), but the required user interaction (UI:R) and only Low confidentiality/integrity/availability impacts temper the real-world severity - this is a client-side script-execution flaw, not server-side code execution. No EPSS score was supplied in the input, so exploitation probability cannot be quantified here. KEV status is not present (not actively exploited) and no POC is referenced, so this is a credible but not urgent priority relative to actively exploited or wormable issues. One caveat: the CVSS vector claims network vector with no privileges, which fits an unauthenticated XSS, but the specific injection sink (reflected vs stored) is not stated in the source data and should be confirmed against the Patchstack advisory, since a stored variant would raise practical risk.

An attacker crafts a URL or directory-submission payload containing malicious JavaScript that the Simple Link Directory plugin renders without sanitization, then distributes the link via email, social media, or a comment. When a victim (potentially a logged-in administrator) clicks or views the page, the script runs in their browser session and can steal cookies, forge admin actions, or redirect them. No public exploit code is identified at time of analysis, but the low attack complexity (AC:L) makes weaponization straightforward for anyone who identifies the injection point.