Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-06
Permalink Manager - Security Vulnerability (CVE-2026-122222)
The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slug' parameter in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An Author-level attacker can submit a percent-encoded HTML/JavaScript payload as a post slug via the REST API, which survives sanitization intact and executes in an administrator's browser session…
PLUGIN
Permalink Manager
CVE-2026-122222
Risk Score
Threat Entry
Updated 2026-06-17
Permalink Manager - Cross-Site Scripting (XSS) (CVE-2026-8494)
The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in the admin URI Editor interface in all versions up to, and including, 2.5.3.3 due to insufficient output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in the admin Permalink Manager page that will execute whenever an administrator accesses the Permalink Manager page.
PLUGIN
Permalink Manager
CVE-2026-8494
Risk Score
Threat Entry
Updated 2026-06-17
Permalink Manager - Broken Access Control (CVE-2026-32413)
Missing Authorization vulnerability in Maciej Bis Permalink Manager Lite permalink-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Permalink Manager Lite: from n/a through < 2.5.3.
PLUGIN
Permalink Manager
CVE-2026-32413
Risk Score
Threat Entry
Updated 2026-06-17
Permalink Manager - Information Disclosure (CVE-2025-59010)
Insertion of Sensitive Information Into Sent Data vulnerability in Maciej Bis Permalink Manager Lite permalink-manager allows Retrieve Embedded Sensitive Data.This issue affects Permalink Manager Lite: from n/a through
PLUGIN
Permalink Manager
CVE-2025-59010
Risk Score
Threat Entry
Updated 2026-06-17
Permalink Manager - Broken Access Control (CVE-2024-8195)
The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'debug_data', 'debug_query', and 'debug_redirect' functions in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to extract sensitive data including password, title, and content of password-protected posts.
PLUGIN
Permalink Manager
CVE-2024-8195
Risk Score
Threat Entry
Updated 2026-06-17
Permalink Manager - Cross-Site Scripting (XSS) (CVE-2022-0201)
The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escape query parameters before outputting them back in the debug page, leading to a Reflected Cross-Site Scripting issue
PLUGIN
Permalink Manager
CVE-2022-0201
Risk Score