Permalink Manager Lite

Permalink Manager Lite has 14 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 14 are fixed as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high. 2024 was the busiest year with 6 disclosures.

The most common weakness is Cross-Site Scripting, behind 6 of the records (43%). Other recurring categories include Missing Authorization, Authorization Bypass Through User-Controlled Key.

Every one of the 14 issues recorded for Permalink Manager Lite has a vendor fix available, so running the current release closes all known holes.

11 independent researchers contributed these findings, most of them (3) reported by Muhammad Zeeshan (Xib3rR4dAr). Permalink Manager Lite is installed on roughly 100,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

01234567891009.01.2016Today27.09.20217.2Permalink Manager Lite <= 2.2.12 - Admin+ SQL Injection CVSS 7.2 · 27.09.202117.01.20226.1Permalink Manager Lite <= 2.2.14 Reflected Cross-Site Scripting CVSS 6.1 · 17.01.202201.11.20226.5Permalink Manager Lite <= 2.2.20 - Missing Authorization CVSS 6.5 · 01.11.202216.11.20228.8Permalink Manager Lite <= 2.2.20.1 - Cross-Site Request Forgery CVSS 8.8 · 16.11.202214.12.20226.4Permalink Manager Lite <= 2.2.20.3 - Authenticated Stored Cross-Site Scripting CVSS 6.4 · 14.12.202215.03.20246.1Permalink Manager Lite <= 2.4.3 - Reflected Cross-Site Scripting CVSS 6.1 · 15.03.202418.03.20245.4Permalink Manager <= 2.4.3.1 - Missing Authorization to Authenticated(Author+) Arbitrary Post Slug Modification CVSS 5.4 · 18.03.202420.03.20246.1Permalink Manager Lite and Permalink Manager Pro <= 2.4.3.1 - Reflected Cross-Site Scripting CVSS 6.1 · 20.03.20244.3Plugin Permalink <= 2.4.3.1 - Missing Authorization via get_uri_editor CVSS 4.3 · 20.03.202427.06.20246.1Permalink Manager Lite <= 2.4.3.3 - Reflected Cross-Site Scripting CVSS 6.1 · 27.06.202427.08.20245.3Permalink Manager Lite <= 2.4.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure CVSS 5.3 · 27.08.202406.09.20255.3Permalink Manager Lite <= 2.5.1.3 - Unauthenticated Sensitive Information Exposure CVSS 5.3 · 06.09.202525.02.20265.3Permalink Manager Lite < 2.5.3 - Missing Authorization CVSS 5.3 · 25.02.202616.06.20266.4Permalink Manager Lite <= 2.5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title CVSS 6.4 · 16.06.2026

Strategic Overview

Avg CVSSMedium
6.1/ 10
Patch Coverage100%
Open

0

Fixed

14

Get automatic notifications for all Permalink Manager Lite vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2022-4021

Permalink Manager Lite <= 2.2.20.1 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

14 records
2026-06-16 17:40CVE-2026-8494
6.4
Medium
Ahmad MarzoukYes
2026-02-25 00:00CVE-2026-32413
5.3
Medium
hhhaiYes
2025-09-06 00:00CVE-2025-59010
5.3
Medium
Que Thanh Tuan - Blue RockYes
2024-08-27 00:00CVE-2024-8195
5.3
Medium
stealthcopterYes
2024-06-27 00:00CVE-2024-37257
6.1
Medium
Rafie MuhammadYes
2024-03-20 00:00CVE-2024-2738
6.1
Medium
Muhammad Zeeshan (Xib3rR4dAr)Yes
2024-03-20 00:00CVE-2024-2543
4.3
Medium
Muhammad Zeeshan (Xib3rR4dAr)Yes
2024-03-18 00:00CVE-2024-2538
5.4
Medium
Muhammad Zeeshan (Xib3rR4dAr)Yes
2024-03-15 00:00CVE-2024-29092
6.1
Medium
Rafie MuhammadYes
2022-12-14 00:00CVE-2022-4410
6.4
Medium
Nicole SheininYes
Showing 1–10 of 14 reports
Permalink Manager Lite banner
Latestv2.6.0

Permalink Manager Lite

Maciej Bis

Author

Maciej Bis

4.8(176)
96/100
Last Updated
2026-08-09 (1mo ago)
Active Installs
100,000+
Downloads
3,044,218
Requires WP
5.3.0+
Requires PHP
5.4+
Tested up to
WP 7.1
Created
2016-01-09 (11y ago)

The native WordPress permalink system is designed to be simple and easy to configure. Permalink Manager extends it and allows you to define custom URL structures and edit individual permalinks exactly the way you want. The free version lets you manage URLs for posts, pages, and custom post types, while the Pro version also includes support for categories, tags, and custom taxonomies. Documentation | Buy Permalink Manager Pro The plugin supports all custom post types and taxonomies, and it is compatible with popular plugins like WooCommerce, Yoast SEO, WPML, and Polylang. Permalink Manager automatically redirects original and duplicate URLs to the correct page. Using the canonical redirect, it prevents the broken links that can hurt the UX and SEO, potentially causing a drop in organic traffic. Features Change Single Permalinks For a consistent and SEO-friendly URL structure, you may customize and change the permalink of each post, page, and custom post type item. Categories, tags & custom taxonomies terms permalinks can be edited in Permalink Manager Pro. Customize URL Formats Using the “Permastructures” settings, you can choose the default format for custom URLs using “Permastructures” settings. The new format will be applied automatically when a new post/term is added or once the old permalinks are regenerated. Custom Post Types Support Choose the post types and taxonomies you want to customize and exclude the rest of them. The plugin supports post types and taxonomies managed with ACF, Pods, JetEngine, Toolset Types, and other plugins. Translate Permalinks With WPML or Polylang active, Permalink Manager allows you to translate the slug and customize the URL structure for every language separately. Remove Parent Slugs Remove parent slugs from your WordPress URLs organize them hierarchically by adding categories to custom permalinks, all without writing a single line of code. Canonical Redirect Automatically redirect old URLs whenever they change, preventing broken links, and protecting your site’s search visibility. Additional features available in Permalink Manager Pro The free version covers all the necessary functions, while the premium version adds a few handy functionalities that can improve the process of adjusting WordPress permalinks. Click here for additional information and to purchase Permalink Manager Pro. Custom Taxonomies Support Taxonomies are fully supported in the premium version (categories, tags & custom taxonomies). You may adjust individual term permalinks or change them all at once using “Permastructures”. Full WooCommerce Support Permalink Manager Pro may be used to change the URL addresses of WooCommerce products, tags, categories, and attributes. For example, you may use the plugin to remove /product/ and /product-category/ from WooCommerce URL. Custom Fields Support Permalink Manager is the only actively supported WordPress plugin that allows to add custom fields to permalinks and requires no technical experience. Extra Redirects Define extra redirects (aliases) for any post, page, or term. Additionally, you may assign a redirect URL to each post/term, which will take users to any external URL address. REST API Support Access and manage custom permalinks via the REST API.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C