Skip to content
OpenAdvisories

Vendor

mbis

8 known vulnerabilities.

Products

Permalink Manager Lite 8 Permalink Manager Pro 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-122222

    Permalink Manager Lite <= 2.6.1 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug

    The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slug' parameter in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authentica…

    mbis Permalink Manager Lite Web / CMS
  • Medium 6.4
    CVE-2026-8494

    Permalink Manager Lite <= 2.5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title

    The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in the admin URI Editor interface in all versions up to, and including, 2.5.3.3 due to insufficient output escaping. This makes it possible for authen…

    mbis Permalink Manager Lite Web / CMS
  • Medium 5.3
    CVE-2024-8195

    Permalink Manager Lite <= 2.4.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure

    The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'debug_data', 'debug_query', and 'debug_redirect' functions in all versions up to, and including, 2.4.4. This makes it possib…

    mbis Permalink Manager Lite Web / CMS
  • Medium 4.3
    CVE-2024-2543

    Plugin Permalink <= 2.4.3.1 - Missing Authorization via get_uri_editor

    The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_uri_editor' function in all versions up to, and including, 2.4.3.1. This makes it possible for unauthenticated attackers…

    mbis Permalink Manager Lite Web / CMS
  • Medium 6.1
    CVE-2024-2738

    Permalink Manager Lite and Permalink Manager Pro <= 2.4.3.1 - Reflected Cross-Site Scripting

    The Permalink Manager Lite and Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘s’ parameter in multiple instances in all versions up to, and including, 2.4.3.1 due to insufficient input sanitization and output escaping. Thi…

    mbis Permalink Manager Lite Permalink Manager Pro
  • Medium 5.4
    CVE-2024-2538

    Permalink Manager <= 2.4.3.1 - Missing Authorization to Authenticated(Author+) Arbitrary Post Slug Modification

    The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_save_permalink' function in all versions up to, and including, 2.4.3.1. This makes it possible for authenticated …

    mbis Permalink Manager Lite Web / CMS
  • Medium 6.4
    CVE-2022-4410

    Permalink Manager Lite <= 2.2.20.3 - Authenticated Stored Cross-Site Scripting

    The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including 2.2.20.3 due to improper output escaping on post/page/media titles. This makes it possible for attackers to inject arbitrary web scri…

    mbis Permalink Manager Lite Web / CMS