CVE-2026-53741 — Simple Link Directory through 9.0.4 Stored XSS via sld_no_results_found Option
Simple Link Directory through 9.0.4 interpolates the sld_no_results_found option into a JavaScript string literal without encoding. Because sanitize_text_field leaves quotes int…
Published: 2026-06-10 · CVSS: 5.1 · CVSS 4.0
Simple Link Directory through 9.0.4 interpolates the sld_no_results_found option into a JavaScript string literal without encoding. Because sanitize_text_field leaves quotes intact, a stored payload breaks out of the string and runs script for every page visitor.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7