CVE-2026-8494
published 2026-06-17CVE-2026-8494: Permalink Manager Lite <= 2.5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title The Permalink Manager Lite plugin for WordPress is…
medium6.4CVSS 3.1
AVNACLPRLUINSCCLILAN
EPSS
0.19%
9.2th percentile
Permalink Manager Lite <= 2.5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in the admin URI Editor interface in all versions up to, and including, 2.5.3.3 due to insufficient output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in the admin Permalink Manager page that will execute whenever an administrator accesses the Permalink Manager page.
Timeline: 2026-06-16: Disclosed
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mbis | permalink_manager_lite | <= 2.5.3.3 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
mbis Permalink Manager Lite Plugin up to 2.5.3.3 on WordPress Admin URI Editor Interface cross site scripting (EUVD-2026-37563)
vuldb·2026-06-18
CVE-2026-8494 [LOW] mbis Permalink Manager Lite Plugin up to 2.5.3.3 on WordPress Admin URI Editor Interface cross site scripting (EUVD-2026-37563)
A vulnerability classified as problematic has been found in mbis Permalink Manager Lite Plugin up to 2.5.3.3 on WordPress. The affected element is an unknown function of the component Admin URI Editor Interface. This manipulation causes cross site scripting.
The identification of this vulnerability is CVE-2026-8494. It is possible to initiate the attack remotely. There is no exploit available.
GHSA
The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in the admin URI Editor interface in all versions up to, and including, 2.5.3.3 due to insu
ghsa_unreviewed·2026-06-17
CVE-2026-8494 [MEDIUM] CWE-79 The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in the admin URI Editor interface in all versions up to, and including, 2.5.3.3 due to insu
The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in the admin URI Editor interface in all versions up to, and including, 2.5.3.3 due to insufficient output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in the admin Permalink Manager page that will execute whenever an administrator accesses the Permalink Manager page.
CVEList
Permalink Manager Lite <= 2.5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
cvelistv5·2026-06-17·CVSS 6.4
CVE-2026-8494 [MEDIUM] CWE-79 Permalink Manager Lite <= 2.5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
Permalink Manager Lite <= 2.5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in the admin URI Editor interface in all versions up to, and including, 2.5.3.3 due to insufficient output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in the admin Permalink Manager page that will execute whenever an administrator accesses the Permalink Manager page.
Timeline: 2026-06-16: Disclosed
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-17
Published