Description

The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slug' parameter in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An Author-level attacker can submit a percent-encoded HTML/JavaScript payload as a post slug via the REST API, which survives sanitization intact and executes in an administrator's browser session when the URI Editor admin page is loaded.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-11-06T09:17:00.910Z",
  "pubdate": "2026-11-06T09:17:00.910Z",
  "executiveSummary": "The Permalink Manager Lite plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability occurring within the 'slug' parameter.\nThis vulnerability affects all versions up to and including 2.6.1.\nThe root cause is identified as insufficient input sanitization and output escaping during the handling of post slugs.\nThe vulnerability enables authenticated attackers with author-level permissions or higher to inject malicious JavaScript payloads.\nBy submitting percent-encoded HTML or JavaScript through the REST API, an attacker can ensure the malicious code persists within the database.\nThe payload executes in the context of an administrator's browser session when the victim accesses the URI Editor admin page.\nThe impact includes potential unauthorized administrative actions, session hijacking, or exfiltration of sensitive site data.\nSuccessful exploitation requires authenticated access to the WordPress environment, specifically an author account or greater.",
  "technicalDetails": "The vulnerability resides in the way Permalink Manager Lite handles post slug updates through the WordPress REST API.\nThe application fails to perform rigorous input validation or sanitization on the 'slug' parameter, allowing percent-encoded payloads to bypass standard security filters.\nWhen an attacker with author-level privileges submits a crafted request via the REST API, the malicious script is stored directly in the database without being properly escaped.\nThe attack flow begins when the authenticated attacker sends a REST API request to modify a post slug, inserting an XSS payload encoded in a percent-encoded format.\nBecause the sanitization logic is insufficient, the payload remains intact during the database write process.\nThe vulnerability remains latent until an administrator navigates to the 'URI Editor' admin page, which is a component of the Permalink Manager Lite plugin.\nUpon loading this page, the stored malicious script is rendered into the HTML document context of the administrator's browser.\nBecause the code executes within the administrator's session, the attacker inherits the victim's privileges within the WordPress application.\nThis execution leads to potential post-exploitation scenarios, including the creation of rogue administrator accounts, modifications to plugin configurations, or the injection of additional persistent backdoors.\nThe exploitation is deterministic; once the payload is placed into the slug, the script triggers automatically whenever the administrative interface attempts to display or manage the affected URI, effectively weaponizing the backend management page against its authorized users.\nThe attack does not require external network exposure, as it occurs via the application's internal API, but the privilege requirement restricts the attack surface to authenticated users within the WordPress system."
}