The Simple Link Directory WordPress plugin contains a stored XSS flaw triggered via the `qcopd-directory` shortcode’s attributes such as title_font_size. Because the plugin fails to properly sanitize and escape user input, an authenticated contributor or higher can inject arbitrary JavaScript that executes on any page displaying the injected shortcode. This flaw can lead to session hijacking, defacement, or other malicious client‑side actions. The weakness is classified as CWE‑79.

All installations of the Simple Link Directory plugin from the earliest release up through version 8.9.2 are affected. The plugin is supplied by quantumcloud for WordPress. Versions from 8.9.3 onward contain the fix, so any site still using 8.9.2 or earlier is at risk.

The vulnerability carries a CVSS score of 6.4, indicating moderate severity. No EPSS data is available, and the flaw is not listed in the CISA KEV catalog. Exploitation requires a user to have contributor‑level or higher access to add or edit the shortcode, which is a fairly common permission in many sites. Once the attacker injects the payload, it persists until the corresponding shortcode is removed or the plugin is updated. The attack can be performed by any authenticated user with sufficient privileges and would affect all visitors who load the affected page.