Description
The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escape query parameters before outputting them back in the debug page, leading to a Reflected Cross-Site Scripting issue
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Maciej Bis | Permalink Manager Lite | 2.2.15 – < 2.2.15 | 2.2.15 |
| Maciej Bis | Permalink Manager Pro | 2.2.15 – < 2.2.15 | 2.2.15 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- WordPress Permalink Manager <2.2.15 - Cross-Site Scripting http/cves/2022/CVE-2022-0201.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.