CVE-2026-53742
Simple Link Directory through 9.0.4 Stored XSS via Embed Shortcode AttributesSimple Link Directory through 9.0.4 echoes embed shortcode attributes into HTML data attributes without escaping in the embedder template. Attackers with contributor access can craft a shortcode attribute that injects an event handler executing in a viewer's browser.
We have discovered 4 live websites that are affected by CVE-2026-53742.
Affected Software
| Product |  Simple Link Directory |
| Category | Wordpress Plugins |
| Vulnerable Domains | 4 live websites (100% of Simple Link Directory install base) |
| Vulnerable Versions |
|
| Vulnerable Versions Count | 1 versions ( 100% of all versions) |
Details
- Published - Jun 10, 2026
- Updated - Jun 11, 2026
Credits
- Scott Moore - VulnCheck (finder)
CVE References
Website Distribution by Country
Number of websites using CVE-2026-53742 United States | 3 websites |
 India | 1 websites |
Website Distribution by TLD
Number of websites using CVE-2026-53742| .com | 3 websites |
| .nl | 1 websites |
Vulnerable Versions
Vulnerable versions are highlighted in redWebsites affected by CVE-2026-53742
Top websites that are affected by CVE-2026-53742. Please click on the "Contact us" link to get more information.| Domain | Country | Rank | Contacts |
|---|---|---|---|
| ***********.nl | United States | *,***,*** | |
| **********.com | United States | **,***,*** | |
| ************.com | India | **,***,*** | |
| *******************.com | United States | **,***,*** |
FAQ
A total of 4 websites have been identified as vulnerable to CVE-2026-53742, based on global website indexing conducted by WebTechSurvey.
The Simple Link Directory is affected by the CVE-2026-53742 vulnerability.
Simple Link Directory versions up to and including 9.0.4 are vulnerable to CVE-2026-53742.