What is the CVSS score of EUVD-2026-37563?

EUVD-2026-37563 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Permalink Manager Lite EUVD-2026-37563

| CVE-2026-8494 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-17 Wordfence

WordPress XSS Permalink Manager Lite

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

UI:R corrects the provided vector because payload execution requires an administrator to actively visit the URI Editor page; all other metrics align with a network-reachable, low-complexity stored XSS with changed scope.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 08:31 vuln.today

CVE Published

Jun 17, 2026 - 06:49 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in the admin URI Editor interface in all versions up to, and including, 2.5.3.3 due to insufficient output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in the admin Permalink Manager page that will execute whenever an administrator accesses the Permalink Manager page.

AnalysisAI

Stored Cross-Site Scripting in the Permalink Manager Lite WordPress plugin (all versions through 2.5.3.3) allows authenticated contributors to inject persistent JavaScript into the admin URI Editor interface via crafted post titles. The payload executes in the browser of any administrator who subsequently visits the Permalink Manager page, enabling session hijacking or unauthorized admin-level actions. No active exploitation is confirmed in CISA KEV, and no public exploit code has been identified at time of analysis; vendor-released patch 2.5.3.4 is available.

Technical ContextAI

The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) within the WordPress plugin Permalink Manager Lite, developed by mbis (CPE: cpe:2.3:a:mbis:permalink_manager_lite:*:*:*:*:*:*:*:*). The specific failure is in the view file permalink-manager-uri-editor-post.php at line 150, as confirmed by WordPress Plugin Trac browser references for tags 2.5.3.1 and 2.5.3.3. Post titles entered by Contributor-level users are rendered in the admin-facing URI Editor interface without adequate output escaping, meaning any HTML or JavaScript embedded in a post title is passed directly to the DOM when an administrator accesses the Permalink Manager page. WordPress Contributors have the built-in capability to create posts and draft content, making their post titles an attacker-controlled input that flows into a privileged administrative view.

RemediationAI

Upgrade Permalink Manager Lite to version 2.5.3.4 or later, which resolves the output escaping deficiency in includes/views/permalink-manager-uri-editor-post.php. The fix is confirmed available in the WordPress Plugin Trac at https://plugins.trac.wordpress.org/browser/permalink-manager/tags/2.5.3.4/includes/views/permalink-manager-uri-editor-post.php. If immediate patching is not feasible, restrict the granting of Contributor-level (or higher) roles to verified, trusted users only, as exploitation is entirely dependent on having at minimum Contributor access - removing untrusted contributors eliminates the attack surface without disabling the plugin. Site administrators should also audit existing post titles from low-trust contributors for embedded script tags prior to upgrading. Note that restricting user roles is an operational control, not a technical fix, and should not substitute for patching.