What is the CVSS score of CVE-2026-7209?

CVE-2026-7209 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Simple Link Directory CVE-2026-7209

EUVD-2026-26729 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-02 security@wordfence.com

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 04:30 vuln.today

EUVD ID Assigned

May 02, 2026 - 04:22 euvd

EUVD-2026-26729

Analysis Generated

May 02, 2026 - 04:22 vuln.today

CVE Published

May 02, 2026 - 04:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Simple Link Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's qcopd-directory shortcode in all versions up to, and including, 8.9.2. This is due to insufficient input sanitization and output escaping on user supplied attributes such as title_font_size. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Simple Link Directory plugin for WordPress up to version 8.9.2 allows authenticated contributors and above to inject arbitrary JavaScript through insufficiently sanitized shortcode attributes like title_font_size, which executes in the browsers of all users accessing affected pages. The vulnerability affects the qcopd-directory shortcode and requires contributor-level WordPress access to exploit, making it a moderate-to-high risk for multi-author WordPress sites without strict role management.

Technical ContextAI

The Simple Link Directory WordPress plugin fails to properly sanitize and escape user-supplied input passed to the qcopd-directory shortcode. Specifically, attributes such as title_font_size are processed without adequate input validation before being inserted into page output (referenced in qc-op-directory-shortcodes.php and templates/style-1/template.php). This is a classic Stored XSS vulnerability (CWE-79) where malicious payloads persist in the WordPress database and are rendered to all subsequent visitors. The vulnerability requires WordPress authentication at contributor level or higher, meaning the attacker must either be a legitimate site user or compromise an account with such privileges. WordPress shortcodes execute within the post content rendering pipeline, making them a common attack surface when attributes are not escaped using appropriate WordPress functions like esc_attr() or wp_kses_post().

RemediationAI

Update Simple Link Directory to version 8.9.4 or later, which appears to contain sanitization fixes based on code repository references. The update can be applied directly from the WordPress plugin dashboard (Plugins → Updates) or via WP-CLI. For sites unable to update immediately, restrict the qcopd-directory shortcode to trusted authors only via custom code or security plugins that filter shortcode permissions by user role. Additionally, conduct a security audit of all posts and pages created by contributors to identify and remove any suspicious shortcodes or script injections before updating. Consider implementing a WordPress security plugin (such as Wordfence, Sucuri, or iThemes Security) that can monitor shortcode usage and alert on suspicious modifications. Review WordPress user roles and audit all contributor-level and above accounts, revoking access for unused or compromised accounts.