sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total13
Critical0
High4
Medium9
Reset
Showing 1-13 of 13 records
Threat Entry Updated 2026-11-06

Permalink Manager Lite - Security Vulnerability (CVE-2026-122222)

The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slug' parameter in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An Author-level attacker can submit a percent-encoded HTML/JavaScript payload as a post slug via the REST API, which survives sanitization intact and executes in an administrator's browser session…

PLUGIN Permalink Manager Lite

CVE-2026-122222

MEDIUM CVSS 6.4 2026-11-06
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Permalink Manager Lite - Cross-Site Scripting (XSS) (CVE-2026-8494)

The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in the admin URI Editor interface in all versions up to, and including, 2.5.3.3 due to insufficient output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in the admin Permalink Manager page that will execute whenever an administrator accesses the Permalink Manager page.

PLUGIN Permalink Manager Lite

CVE-2026-8494

MEDIUM CVSS 6.4 2026-06-17
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Permalink Manager Lite - Broken Access Control (CVE-2024-8195)

The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'debug_data', 'debug_query', and 'debug_redirect' functions in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to extract sensitive data including password, title, and content of password-protected posts.

PLUGIN Permalink Manager Lite

CVE-2024-8195

MEDIUM CVSS 5.3 2024-08-28
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Permalink Manager Lite - Cross-Site Scripting (XSS) (CVE-2024-2738)

The Permalink Manager Lite and Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘s’ parameter in multiple instances in all versions up to, and including, 2.4.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

PLUGIN Permalink Manager Lite

CVE-2024-2738

MEDIUM CVSS 6.1 2024-04-09
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Permalink Manager Lite - Broken Access Control (CVE-2024-2543)

The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_uri_editor' function in all versions up to, and including, 2.4.3.1. This makes it possible for unauthenticated attackers to view the permalinks of all posts.

PLUGIN Permalink Manager Lite

CVE-2024-2543

MEDIUM CVSS 4.3 2024-04-09
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Permalink Manager Lite - Broken Access Control (CVE-2024-2538)

The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_save_permalink' function in all versions up to, and including, 2.4.3.1. This makes it possible for authenticated attackers, with author access and above, to modify the permalinks of arbitrary posts.

PLUGIN Permalink Manager Lite

CVE-2024-2538

MEDIUM CVSS 5.4 2024-03-20
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Permalink Manager Lite - Cross-Site Scripting (XSS) (CVE-2022-4410)

The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including 2.2.20.3 due to improper output escaping on post/page/media titles. This makes it possible for attackers to inject arbitrary web scripts on the permalink-manager page if another plugin or theme is installed on the site that allows lower privileged users with unfiltered_html the ability to modify post/page titles with malicious web scripts.

PLUGIN Permalink Manager Lite

CVE-2022-4410

MEDIUM CVSS 6.4 2022-12-14
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Permalink Manager Lite - Cross-Site Request Forgery (CSRF) (CVE-2022-4021)

The Permalink Manager Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.2.20.1. This is due to missing or incorrect nonce validation on the extra_actions function. This makes it possible for unauthenticated attackers to change plugin settings including permalinks and site maps, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.

PLUGIN Permalink Manager Lite

CVE-2022-4021

HIGH CVSS 8.8 2022-11-16
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.