Medium severity · published Feb 14, 2022
CVE-2022-0201
Permalink Manager < 2.2.15 - Reflected Cross-Site Scripting
6.1
CVSS
3.4%
EPSS
No
On KEV
Description
The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escape query parameters before outputting them back in the debug page, leading to a Reflected Cross-Site Scripting issue
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)3.4% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PM
Permalink Manager Lite · Maciej Bis
2.2.15 before 2.2.15 · source: vendor, NVD
PM
Permalink Manager Pro · Maciej Bis
2.2.15 before 2.2.15 · source: vendor
PM
Permalink Manager · Permalink Manager Project
before 2.2.15 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-0201
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-0201
Patch
https://plugins.trac.wordpress.org/changeset/2656512
Exploit
https://wpscan.com/vulnerability/f274b0d8-74bf-43de-9051-29ce36d78ad4
More from Permalink Manager Lite
9.8
CVE-2022-41781
WordPress Permalink Manager Lite plugin <= 2.2.20 - Broken Access Control vulnerability
7.5
CVE-2025-59010
WordPress Permalink Manager Lite Plugin <= 2.5.1.3 - Sensitive Data Exposure Vulnerability
6.1
CVE-2024-37257
WordPress Permalink Manager Lite plugin <= 2.4.3.3 - Reflected Cross Site Scripting (XSS) vulnerability
6.1
CVE-2024-29092
WordPress Permalink Manager Lite plugin <= 2.4.3 - Reflected Cross Site Scripting (XSS) vulnerability
5.3
CVE-2026-32413
WordPress Permalink Manager Lite plugin < 2.5.3 - Broken Access Control vulnerability