CVE-2026-7209

Vulnerability

Overview The Simple Link Directory plugin for WordPress, up to and including version 8.9.2, contains a Stored Cross-Site Scripting (XSS) vulnerability in its qcopd-directory shortcode. The root cause is insufficient input sanitization and output escaping on user-supplied attributes such as title_font_size. This flaw allows authenticated attackers to inject arbitrary web scripts that are stored on the server and executed when other users access the affected page [1].

Exploitation

Prerequisites Exploitation requires an authenticated user with at least contributor-level access to the WordPress site. The attacker can craft a post or page containing the vulnerable shortcode with malicious payloads in attributes like title_font_size. No additional network position or special privileges beyond contributor are needed, as the shortcode is available to any user who can create content [1].

Impact

Successful exploitation enables the attacker to inject arbitrary JavaScript or HTML into the page. This script executes in the context of any visitor who views the compromised page, potentially leading to session hijacking, defacement, or theft of sensitive information. The stored nature of the XSS means the payload persists until the malicious content is removed [1].

Mitigation

As of the publication date, the vulnerability affects all versions up to 8.9.2. Users are advised to update to a patched version if available, or to restrict contributor-level access and carefully review shortcode attributes in user-generated content. No workaround is mentioned in the reference [1].