Unauthenticated XSS in Simple Link Directory

Executive Summary

CVE-2026-57682 is a Cross Site Scripting (XSS) vulnerability found in the WordPress Simple Link Directory Plugin versions 15.0.5 and below.

This vulnerability allows attackers to inject malicious scripts, such as redirects or advertisements, into websites using the plugin.

These malicious scripts execute when visitors access the affected site.

Exploitation requires a privileged user to perform an action like clicking a malicious link.

The vulnerability is classified under OWASP Top 10 A3: Injection and has a CVSS score of 7.1, indicating moderate danger.

Useful 0 Not Useful 0

Mitigation Strategies

Users are advised to update the WordPress Simple Link Directory Plugin to version 15.0.6 or later immediately to mitigate the vulnerability.

Until the update is applied, Patchstack offers a mitigation rule that can be used to block attacks exploiting this vulnerability.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to attackers injecting malicious scripts into your website, which can execute when visitors access your site.

• Visitors could be redirected to malicious sites.
• Attackers could display unwanted advertisements.
• It may result in compromised user trust and damage to your website's reputation.

Because exploitation requires a privileged user to interact with a malicious link, the risk involves social engineering or insider threats.

Useful 0 Not Useful 0