Permalink Manager Lite <= 2.2.14 is vulnerable to Unauthorized Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated

Published
2022-01-11

The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escape query parameters before outputting them back in the debug page, leading to a Reflected Cross-Site Scripting issue

CVE

https://www.cve.org/CVERecord?id=CVE-2022-0201

CVSS

Score:6.1

Severity:Medium

Version: 2.2.14

There is a patch available in v2.2.15 and we strongly recommend you update to this version as soon as possible.