Simple Link Directory Vulnerabilities

The Simple Link Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `qcopd-directory` shortcode in all versions up to, and including, 8.9.2. This is due to insufficient input sanitization and output escaping on user supplied attributes such as `title_font_size`. This makes it po...

CVSS:

6.4

Affected:

up to 8.9.2

Fixed in:

8.9.4

Disclosed:

May 1, 2026

CVE-2026-7209 on NVD →

The Simple Link Directory plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 8.8.3. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 8.8.3

Fixed in:

8.8.4

Disclosed:

Dec 15, 2025

CVE-2025-67576 on NVD →

The Simple Link Directory plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.8.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can trick a site...

CVSS:

4.3

Affected:

up to 8.8.3

Fixed in:

8.8.4

Disclosed:

Dec 15, 2025

CVE-2025-67465 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in QuantumCloud Simple Link Directory simple-link-directory allows Cross Site Request Forgery.This issue affects Simple Link Directory: from n/a through <= 8.8.3.

Affected:

up to 8.8.3

Fix:

No patched version reported

Disclosed:

Dec 9, 2025

CVE-2025-67465 on NVD →

[en] Missing Authorization vulnerability in QuantumCloud Simple Link Directory simple-link-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Link Directory: from n/a through <= 8.8.3.

Affected:

up to 8.8.3

Fix:

No patched version reported

Disclosed:

Dec 9, 2025

CVE-2025-67576 on NVD →

[en] The The Simple Link Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.4.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthentica...

Affected:

up to 8.4.1

Fixed in:

8.4.1

Disclosed:

Dec 13, 2024

CVE-2024-12417 on NVD →

The The Simple Link Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.4.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated a...

CVSS:

6.5

Affected:

up to 8.4.5

Fixed in:

8.4.6

Disclosed:

Dec 12, 2024

CVE-2024-12417 on NVD →

[en] The Simple Link Directory WordPress plugin before 7.7.2 does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection

Affected:

up to 7.7.2

Fixed in:

7.7.2

Disclosed:

Mar 21, 2022

CVE-2022-0760 on NVD →

The Simple Link Directory WordPress plugin before 7.7.2 does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection.

CVSS:

9.8

Affected:

up to 7.7.2

Fixed in:

7.7.2

Disclosed:

Feb 28, 2022

CVE-2022-0760 on NVD →

[en] An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress allows remote attackers to inject arbitrary web script or HTML, because esc_html is not called for the "echo get_the_title()" or "echo $term->name" statement.

Affected:

up to 7.3.5

Fixed in:

7.3.5

Disclosed:

Mar 20, 2020

CVE-2019-13463 on NVD →

An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress allows remote attackers to inject arbitrary web script or HTML, because esc_html is not called for the "echo get_the_title()" or "echo $term->name" statement.

CVSS:

6.1

Affected:

up to 7.3.5

Fixed in:

7.3.5

Disclosed:

Jul 9, 2019

CVE-2019-13463 on NVD →

The Simple Link Directory plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 5.6.0 via deserialization of untrusted input from the 'settings' parameters as part of the Option Tree framework. This allows authenticated attackers to inject a PHP Object. If a POP chain is present v...

CVSS:

8.8

Affected:

up to 5.6.0

Fixed in:

5.7.0

Disclosed:

Nov 12, 2018

The Simple Link Directory plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 5.6.0 via deserialization of untrusted input from the 'settings' parameters as part of the Option Tree framework. This allows authenticated attackers to inject a PHP Object. If a POP chain is present v...

Affected:

up to 5.7.0

Fixed in:

5.7.0

Disclosed:

Nov 12, 2018

Due to the OptionTree library

Affected:

up to 5.6.0

Fixed in:

5.6.0