EUVD-2026-37563Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
UI:R corrects the provided vector because payload execution requires an administrator to actively visit the URI Editor page; all other metrics align with a network-reachable, low-complexity stored XSS with changed scope.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in the admin URI Editor interface in all versions up to, and including, 2.5.3.3 due to insufficient output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in the admin Permalink Manager page that will execute whenever an administrator accesses the Permalink Manager page.
AnalysisAI
Stored Cross-Site Scripting in the Permalink Manager Lite WordPress plugin (all versions through 2.5.3.3) allows authenticated contributors to inject persistent JavaScript into the admin URI Editor interface via crafted post titles. The payload executes in the browser of any administrator who subsequently visits the Permalink Manager page, enabling session hijacking or unauthorized admin-level actions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a valid WordPress account with at minimum Contributor-level privileges on the target site - unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 score of 6.4 uses the vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, but the UI:N metric conflicts with the CVE description, which explicitly states the payload executes 'whenever an administrator accesses the Permalink Manager page' - a condition that implies UI:R (user interaction required). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A malicious contributor on a multi-author WordPress site creates a post with a title containing a JavaScript payload such as a cookie-stealing script. The post title is stored in the database and later rendered unescaped inside the Permalink Manager URI Editor when a site administrator navigates to that admin page. … |
| Remediation | Upgrade Permalink Manager Lite to version 2.5.3.4 or later, which resolves the output escaping deficiency in `includes/views/permalink-manager-uri-editor-post.php`. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Permalink Manager Lite
View allThe Permalink Manager Lite WordPress plugin before 2.2.13.1 does not validate and escape the orderby parameter before us
Broken Access Control vulnerability in Permalink Manager Lite plugin <= 2.2.20 on WordPress. Rated critical severity (CV
The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa
The Permalink Manager Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and inclu
The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maciej Bis Permali
The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and incl
The Permalink Manager Lite and Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘s’ pa
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Maciej Bis
Permalink Manager Lite versions prior to 2.5.3 lack proper authorization controls, allowing unauthenticated remote attac
The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today