TI-2022-00139 Aliases CVE-2022-0201 GHSA-8pm6-f5wq-7x35

Permalink Manager < 2.2.15 - Reflected Cross-Site Scripting

LOW 33CWE-79Published 2022-02-14 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escape query parameters before outputting them back in the debug page, leading to a Reflected Cross-Site Scripting issue

Why it matters now

EPSS 0.03368 88th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Permalink Manager Lite (Maciej Bis): 2.2.15Permalink Manager Pro (Maciej Bis): 2.2.15

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
mbis	Permalink Manager Lite	2.2.15 to before 2.2.15	2.2.15	Patch available	CNA
mbis	Permalink Manager Pro	2.2.15 to before 2.2.15	2.2.15	Patch available	CNA

Permalink Manager Lite Vendormbis Affected 2.2.15 to before 2.2.15 Fixed in 2.2.15 Patch available CNA
Permalink Manager Pro Vendormbis Affected 2.2.15 to before 2.2.15 Fixed in 2.2.15 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:permalink_manager_lite_project:permalink_manager_lite::::::wordpress::*	before 2.2.15	Vulnerable	mbis
cpe:2.3:a:permalink_manager_project:permalink_manager:::::pro:wordpress::	before 2.2.15	Vulnerable	Permalink Manager Project

cpe:2.3:a:permalink_manager_lite_project:permalink_manager_lite:*:*:*:*:*:wordpress:*:* Versions before 2.2.15 Vulnerable ·mbis
cpe:2.3:a:permalink_manager_project:permalink_manager:*:*:*:*:pro:wordpress:*:* Versions before 2.2.15 Vulnerable ·Permalink Manager Project

Remediation

Fix · CNA Permalink Manager Lite (Maciej Bis) Fixed in 2.2.15
Fix · CNA Permalink Manager Pro (Maciej Bis) Fixed in 2.2.15

Timeline

2026-10-02 Threatist record created from CVE-2022-0201
2026-10-03 Alias added: GHSA-8pm6-f5wq-7x35

References

Exploit 1

https://wpscan.com/vulnerability/f274b0d8-74bf-43de-9051-29ce36d78ad4

Patch 1

https://plugins.trac.wordpress.org/changeset/2656512

TI-2024-02550 Permalink Manager Lite and Permalink Manager Pro <= 2.4.3.1 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
TI-2024-02361 Permalink Manager <= 2.4.3.1 - Missing Authorization to Authenticated(Author+) Arbitrary Post Slug Modification CVSS 3.1MEDIUM 5.4
TI-2022-20157 WordPress Permalink Manager Lite plugin <= 2.2.20 - Broken Access Control vulnerability CVSS 3.1CRITICAL 9.8
TI-2022-03690 Permalink Manager Lite <= 2.2.20.1 - Cross-Site Request Forgery CVSS 3.1HIGH 8.8
TI-2021-07051 Permalink Manager Lite < 2.2.13.1 - Admin+ SQL Injection CVSS 3.1HIGH 7.2
TI-2024-24772 WordPress Permalink Manager Lite plugin <= 2.4.3.3 - Reflected Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences