The Simple Link Directory plugin fails to escape the value of the sld_no_results_found option when rendering it inside a JavaScript string literal. The sanitization function keeps quotation marks, so an attacker can store a payload that injects script code. Users visiting any page that loads the option will have the injected script executed, allowing attackers to steal cookies, perform actions on behalf of the user, or load additional malicious content.

All WordPress sites running the Simple Link Directory plugin from QuantumCloud version 9.0.4 or earlier are impacted. Sites that rely on the plugin’s option to display custom messages when no results are found must be inspected for this vulnerability.

With a CVSS score of 5.1 this vulnerability carries a moderate severity. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, implying no current widespread exploitation reports. The most likely attack path requires an authenticated user with access to modify plugin settings or an attacker able to supply content that influences the sld_no_results_found option. Once stored, the payload is executed for every future visitor without further interaction.