What is the CVSS score of CVE-2026-57682?

CVE-2026-57682 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Simple Link Directory are affected by CVE-2026-57682?

The Simple Link Directory WordPress plugin (QuantumCloud, versions ≤15.0.5) contains an unauthenticated cross-site scripting vulnerability allowing attackers to inject malicious scripts that execute…

How to fix or mitigate CVE-2026-57682?

Within 24 hours: Audit all WordPress installations for Simple Link Directory plugin (QuantumCloud) versions 15.0.5 and earlier; document inventory and affected URLs. Within 7 days: Either deactivate the plugin completely or migrate to a maintained alternative plugin; if operational requirements mandate retention, deploy WAF rules blocking XSS patterns and enforce strict Content Security Policy headers. Within 30 days: Complete plugin replacement/upgrade and conduct post-incident security assessment of affected website instances.

Simple Link Directory CVE-2026-57682

EUVD-2026-41291 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-9547-xvvm-938r

WordPress XSS Wordpress Plugin Simple Link Directory Quantumcloud

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network-reachable XSS (AV:N/PR:N) needing victim interaction (UI:R); script crosses into browser context (S:C) with limited client-side C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:26 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Simple Link Directory <= 15.0.5 versions.

AnalysisAI

Cross-site scripting in the Simple Link Directory WordPress plugin (versions 15.0.5 and earlier, by QuantumCloud) allows unauthenticated remote attackers to inject malicious script that executes in a victim's browser after they interact with a crafted link or page. The CVSS 3.1 vector (AV:N/PR:N/UI:R/S:C) indicates no authentication is required but a user must be lured into triggering the payload, and the changed scope reflects script execution crossing into the browser security context. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Technical ContextAI

The affected component is Simple Link Directory (CPE cpe:2.3:a:quantumcloud:simple_link_directory), a WordPress plugin from vendor QuantumCloud used to build categorized link/business directories on WordPress sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input is reflected or stored into HTML output without adequate sanitization or output encoding. Because the attack is described as unauthenticated (PR:N), the injection point is reachable by anonymous users - typically a front-end directory submission form, search parameter, or listing field processed by the plugin. When the tainted data is rendered, an attacker-controlled <script> or event handler executes in the context of the served page.

RemediationAI

Upgrade the Simple Link Directory plugin to the vendor-fixed release above 15.0.5 as soon as it is confirmed available; No vendor-released patch version identified at time of analysis in the provided data, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/qc-simple-link-directory/vulnerability/wordpress-simple-link-directory-plugin-15-0-5-cross-site-scripting-xss-vulnerability) and the WordPress plugin repository for the exact patched version. Until a patch is applied, place a WAF or virtual patch (Patchstack offers one) in front of the site to filter XSS payloads on the plugin's endpoints - note WAF rules can produce false positives on legitimate rich input. As a stronger compensating control, disable or restrict public access to the plugin's front-end submission and search features (for example, require login before directory submissions or remove the affected shortcode/page), accepting the trade-off of reduced directory functionality; additionally deploy a strict Content-Security-Policy that blocks inline script to limit payload execution, understanding it may break other inline scripts on the site.