Executive Summary

This vulnerability exists in Simple Link Directory through version 9.0.4. It occurs because the software echoes embed shortcode attributes into HTML data attributes without properly escaping them in the embedder template.

As a result, attackers who have contributor access can craft a shortcode attribute that injects an event handler. This event handler can then execute malicious code in the browser of anyone viewing the embedded content.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the execution of malicious scripts in the browsers of users who view the affected embedded content. Since attackers need contributor access to exploit it, they can inject event handlers that run in viewers' browsers, potentially leading to cross-site scripting (XSS) attacks.

Such attacks can compromise user data, hijack user sessions, or perform actions on behalf of the user without their consent.

Useful 0 Not Useful 0