CVE-2026-53741

Name of the Vulnerable Software and Affected Versions Simple Link Directory versions prior to 9.0.5

Description The software interpolates the sld no results found option into a JavaScript string literal without proper encoding. Since the sanitize text field() function does not remove quotes, a stored payload can break out of the string, allowing the execution of arbitrary scripts for every visitor to the page. This is a stored Cross-Site Scripting (XSS) issue, where a malicious script is permanently stored on the target server.

Recommendations Update to version 9.0.5 or later.