Premmerce Permalink Manager CVE-2026-97272

Exploitation requires an unauthenticated attacker to deliver a crafted payload through the Premmerce Permalink Manager for WooCommerce plugin (<= 2.3.13) AND a victim (typically a logged-in administrator) to view the attacker-influenced content - the UI:R metric confirms this required user interaction is the primary limiting factor. It further requires the target WordPress site to run WooCommerce with this specific plugin installed and active. The scope change (S:C) indicates the injected script executes in a different security context (the browser/admin session) than the vulnerable plugin. No authentication is needed by the attacker (PR:N), but the dependency on victim interaction and the specific plugin/WooCommerce deployment meaningfully narrows realistic exploitation.

The CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a network-reachable, low-complexity, unauthenticated reflected/stored XSS whose severity is inflated by the scope-change (S:C) flag and the aggregation of three low impacts rather than by any high-impact outcome. The single most important limiting signal is UI:R - successful exploitation requires an administrator or other victim to load attacker-influenced content, so this is not a wormable or self-propagating flaw. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so there is no evidence of active exploitation; exploitation status is 'no public exploit identified at time of analysis.' The description is sparse: it does not specify the injectable parameter, the sink, or whether the XSS is reflected or stored, which materially affects real-world weaponizability (stored XSS against wp-admin would be more dangerous than a reflected variant needing social engineering). Net: a genuine but moderate, patch-and-move-on issue rather than an emergency - real priority is bounded by the required user interaction, the confidentiality/integrity impacts being only Low, and the plugin's limited deployment footprint.

An unauthenticated attacker crafts a URL or submits input to a vulnerable Premmerce Permalink Manager endpoint that reflects or stores unsanitized data, then lures a logged-in WordPress administrator to view it. When the victim's browser renders the page, attacker JavaScript executes in the wp-admin origin, enabling session/cookie theft, admin-action forgery, or injection of persistent backdoors. No public PoC is currently identified, and the attack depends on victim interaction (UI:R).