CVE-2026-53741 is a stored cross-site scripting vulnerability in quantumcloud's Simple Link Directory plugin up to version 9.0.4. The issue occurs because the sld_no_results_found option is inserted directly into a JavaScript string literal without proper encoding. The sanitization function sanitize_text_field does not neutralize quotes, allowing an attacker to craft a payload that breaks out of the string context and executes arbitrary JavaScript code in the browsers of users visiting affected pages.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the affected website for every visitor. This can lead to session hijacking, defacement, or other malicious actions performed on behalf of the user. The vulnerability requires low attack complexity and no privileges but does require user interaction (UI:P).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted input in the sld_no_results_found option or apply manual encoding to neutralize quotes before insertion into JavaScript contexts.