Stored Cross-Site Scripting Vulnerability in Permalink Manager Lite for WordPress

CVE-2026-8494

What is CVE-2026-8494?

The Permalink Manager Lite plugin for WordPress allows authenticated users with Contributor-level access and above to exploit a Stored Cross-Site Scripting vulnerability. This is caused by insufficient output escaping in the URI Editor interface, enabling attackers to inject arbitrary scripts into post titles. When an administrator navigates to the Permalink Manager page, these scripts can execute, potentially compromising site security. It is crucial for users of affected versions to apply updates to mitigate this risk.

References