CVE-2026-8494
Permalink Manager Lite <= 2.5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
- State
- Published
- Severity
- 6.4 Medium
- Published
- Jun 17, 2026
- Updated
- Jun 17, 2026
- Reserved
- May 13, 2026
Description
The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in the admin URI Editor interface in all versions up to, and including, 2.5.3.3 due to insufficient output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in the admin Permalink Manager page that will execute whenever an administrator accesses the Permalink Manager page.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N | Wordfence |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
Permalink Manager Litembis |
|
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/221c62a8-09c9-405a-bddf-06638437bd39?source=cve
- https://plugins.trac.wordpress.org/browser/permalink-manager/trunk/includes/views/permalink-manager-uri-editor-post.php#L150
- https://plugins.trac.wordpress.org/browser/permalink-manager/tags/2.5.3.1/includes/views/permalink-manager-uri-editor-post.php#L150
- https://plugins.trac.wordpress.org/browser/permalink-manager/tags/2.5.3.3/includes/views/permalink-manager-uri-editor-post.php#L150
- https://plugins.trac.wordpress.org/browser/permalink-manager/tags/2.5.3.4/includes/views/permalink-manager-uri-editor-post.php
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.