Custom Permalinks

Custom Permalinks has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2018 and 2024; all 3 are fixed as of October 2026. Their average CVSS score is 6.2, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 1 high. 2018 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (67%). Other recurring categories include SQL Injection.

Every one of the 3 issues recorded for Custom Permalinks has a vendor fix available, so running the current release closes all known holes.

All of these findings were reported by Ram. Custom Permalinks is installed on roughly 100,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
6.2/ 10
Patch Coverage100%
Open

0

Fixed

3

Get automatic notifications for all Custom Permalinks vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.1

Custom Permalinks <= 1.1 - Authenticated SQL Injection

Read the full analysis

Vulnerability Records

3 records
Custom Permalinks banner
Latestv3.3.3

Custom Permalinks

Sami Ahmed Siddiqui

Author

Sami Ahmed Siddiqui

4.1(116)
82/100
Last Updated
2026-10-13 (14d ago)
Active Installs
100,000+
Downloads
2,713,645
Requires WP
5.9+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2008-11-01 (18y ago)

You want to take control of your WordPress site’s URLs? The Custom Permalinks plugin gives you the power to set unique, custom URLs for any post, page, tag, or category. This means you can design your site’s structure exactly how you envision it, rather than being limited by WordPress’s default settings. When you set a custom permalink, the original post URL will be automatically redirected to your new, customized URL. Key Features A custom URL for any content: Set a unique permalink for any post, page, public custom post type (e.g. WooCommerce products), category, tag, or custom taxonomy term. Permalink structures per post type: Define a structure for each public post type from tags like %year%, %category%, or your custom taxonomies. New content gets its permalink automatically, and you can still edit any permalink by hand. Automatic redirects: The original URL redirects to the custom permalink, so existing links, bookmarks, and search rankings keep working. Multilingual: Works with WPML and Polylang, with a separate custom permalink for each translation. URLs in any language: Permalinks in non-Latin scripts, such as Arabic, Thai, or Cyrillic, work as you type them. All permalinks in one place: The Post Types Permalinks and Taxonomies Permalinks screens list every custom permalink, with search and bulk delete. A role for permalink managers: The Custom Permalinks Manager role lets non-administrators view and edit permalinks. Developer friendly: Filters and actions to add your own tags, generate permalinks in code, and control sanitizing and redirects. Getting Started: Plugin Settings Custom Permalinks adds a Custom Permalinks menu to your WordPress dashboard: Post Types Permalinks and Taxonomies Permalinks: Every custom permalink on your site, with search and bulk delete. Post Types Settings: A permalink structure for each public post type, built from the tags below. Leave a structure empty to keep WordPress’s default for that post type. To set a permalink for an individual post, page, category, or tag, edit that item and look for the Custom Permalink field near the top (or in the sidebar) of the editor screen — enter the URL path you want and save. Available Tags for Permalink Structures When setting up your custom permalink structures, you can use a variety of tags that will dynamically populate the URL. Here’s a breakdown of what’s available: %year%: The year of the post in four digits, eg: 2025 %monthnum%: Month the post was published, in two digits, eg: 01 %day%: Day the post was published in two digits, eg: 02 %hour%: Hour of the day, the post was published, eg: 15 %minute%: Minute of the hour, the post was published, eg: 43 %second%: Second of the minute, the post was published, eg: 33 %post_id%: The unique ID of the post, eg: 123 %category%: A clean version of the category name (its slug). Nested sub-categories will appear as nested directories in the URL. %author%: The post author’s username (login name). Note that this makes usernames visible in your URLs. %postname%: A clean version of the post or page title (its slug). For example, “This Is A Great Post!” becomes this-is-a-great-post in the URL. %parent_postname%: Similar to %postname%, but uses the immediate parent page’s slug if a parent is selected. %parents_postnames%: Similar to %postname%, but includes all parent page slugs if parents are selected. %title%: The title of the post, converted to a slug. For example, “This Is A Great Post!” becomes this-is-a-great-post. Unlike %postname% which is set once, %title% automatically updates in the permalink if the post title changes (unless the post is published or the permalink is manually edited). %ctax_TAXONOMY_NAME%: A clean version of a custom taxonomy’s name. Replace TAXONOMY_NAME with the actual taxonomy name. %ctax_TAXONOMY_NAME_name%: The custom taxonomy term’s name (instead of its slug). Replace TAXONOMY_NAME with the actual taxonomy name. %ctax_parent_TAXONOMY_NAME%: Similar to %ctax_TAXONOMY_NAME%, but includes the immediate parent category/tag slug in the URL if a parent is selected. %ctax_parent_TAXONOMY_NAME_name%: Similar to %ctax_TAXONOMY_NAME_name%, but includes the immediate parent term’s name if a parent is selected. %ctax_parents_TAXONOMY_NAME%: Similar to %ctax_TAXONOMY_NAME%, but includes all parent category/tag slugs in the URL if parents are selected. %ctax_parents_TAXONOMY_NAME_name%: Similar to %ctax_TAXONOMY_NAME_name%, but includes all parent term names if parents are selected. %custom_permalinks_TAG_NAME%: Developers have the flexibility to define their own custom tags (replace _TAG_NAME with your desired name). To ensure these tags resolve to the correct permalinks, simply apply the custom_permalinks_post_permalink_tag filter. Important Note: For new posts, Custom Permalinks will keep updating the permalink while the post is in draft mode, assuming a structure is defined in the plugin settings. Once the post is published or its permalink is manually updated, the plugin will stop automatic updates for that specific post. Custom Permalinks: Fine-Tuning with Filters Custom Permalinks offers a range of filters that empower developers to precisely control its behavior. You can explore all available filters, complete with example code snippets, in our GitHub repository. For Assistance: Premium Users: If you need assistance implementing these filters, please don’t hesitate to reach out to us via our Premium contact support. Other Users: You can also directly reach out to the plugin author via LinkedIn. Need Help or Found a Bug? Support: For one-on-one email support, consider purchasing Custom Permalinks Premium. While some basic support may be provided on the WordPress.org forums, email support is prioritized for premium users. Bug Reports: If you encounter a bug, please report it on GitHub. Make sure to provide complete information to reproduce the issue. GitHub is for bug reports, not general support questions. If you experience any site-breaking issues after upgrading, please report them on the WordPress Forum or GitHub with detailed information. You can always revert to an older version by downloading it from https://wordpress.org/plugins/custom-permalinks/advanced/.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C