CVE-2022-4410: The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including 2.2.20.3 due to improper output…

PriorityP425medium5.4CVSS 3.1

AVNACLPRLUIRSCCLILAN

EPSS

0.56%

42.1th percentile

The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including 2.2.20.3 due to improper output escaping on post/page/media titles. This makes it possible for attackers to inject arbitrary web scripts on the permalink-manager page if another plugin or theme is installed on the site that allows lower privileged users with unfiltered_html the ability to modify post/page titles with malicious web scripts.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
mbis	permalink_manager_lite	<= 2.2.20.3	—
permalink_manager_lite_project	permalink_manager_lite	<= 2.2.20.3	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.