An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress allows remote attackers to inject arbitrary web script or HTML because esc_html is not called for the \echo get_the_title()\ or \echo $term->name\ statement.