Stored Cross-Site Scripting Vulnerability in Permalink Manager Lite for WordPress

CVE-2026-122222

What is CVE-2026-122222?

The Permalink Manager Lite plugin allows for a Stored Cross-Site Scripting vulnerability that can be exploited by authenticated users with author-level access. Due to inadequate input sanitization and output escaping, attackers can inject malicious web scripts via the 'slug' parameter. This vulnerability impacts all versions up to 2.6.1. The malicious scripts remain undetected after the sanitization process and can execute in the browser session of an administrator when the URI Editor page is accessed, potentially leading to unauthorized actions and data exposure.

References