Threat Entry Updated 2024-09-13

CVE-2024-8195 - Permalink Manager Lite Plugin

The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'debug_data', 'debug_query', and 'debug_redirect' functions in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to extract sensitive data including password, title, and content of password-protected posts.

PLUGIN Permalink Manager Lite

CVE-2024-8195

MEDIUM CVSS 5.3 2024-08-28

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-02-13

CVE-2024-2738 - Permalink Manager Lite Plugin

The Permalink Manager Lite and Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘s’ parameter in multiple instances in all versions up to, and including, 2.4.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

PLUGIN Permalink Manager Lite

CVE-2024-2738

MEDIUM CVSS 6.1 2024-04-09

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-02-05

CVE-2024-2543 - Permalink Manager Lite Plugin

The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_uri_editor' function in all versions up to, and including, 2.4.3.1. This makes it possible for unauthenticated attackers to view the permalinks of all posts.

PLUGIN Permalink Manager Lite

CVE-2024-2543

MEDIUM CVSS 4.3 2024-04-09

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-02-05

CVE-2024-2538 - Permalink Manager Lite Plugin

The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_save_permalink' function in all versions up to, and including, 2.4.3.1. This makes it possible for authenticated attackers, with author access and above, to modify the permalinks of arbitrary posts.

PLUGIN Permalink Manager Lite

CVE-2024-2538

MEDIUM CVSS 5.4 2024-03-20

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2022-0201 - Permalink Manager Lite Plugin

The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escape query parameters before outputting them back in the debug page, leading to a Reflected Cross-Site Scripting issue

PLUGIN Permalink Manager Lite

CVE-2022-0201

MEDIUM CVSS 6.1 2022-02-14

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2021-24769 - Permalink Manager Lite Plugin

The Permalink Manager Lite WordPress plugin before 2.2.13.1 does not validate and escape the orderby parameter before using it in a SQL statement in the Permalink Manager page, leading to a SQL Injection

PLUGIN Permalink Manager Lite

CVE-2021-24769

HIGH CVSS 7.2 2021-10-25

Risk Score

Open Full Technical Breakdown