The vulnerability allows an attacker who has contributor‑level access to embed a malicious value within a shortcode attribute. The plugin echoes this attribute directly into an HTML data attribute without escaping, enabling the injection of an event handler that runs arbitrary JavaScript when the page loads. This flaw can lead to the execution of code in the authenticated or unauthenticated user’s browser, potentially exposing session cookies, theft of personal information, or defacement of the site.

QuantumCloud’s Simple Link Directory plugin, versions up to and including 9.0.4, is affected when installed on WordPress sites. Users of any WordPress installation running this plugin version could be impacted.

The CVSS score of 5.1 indicates a moderate severity. Exploitation requires only that the attacker can obtain contributor privileges, which are typically granted to trusted users or developers, making the risk moderate but real. No EPSS score is available, and the vulnerability is not listed in CISA KEV. An attacker can achieve the attack by creating or editing a link entry and inserting malicious code into the shortcode attribute, which is then reflected in the public page for any visitors.