Permalink Manager Lite
Permalink Manager Lite has 14 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 14 are fixed as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high. 2024 was the busiest year with 6 disclosures.
The most common weakness is Cross-Site Scripting, behind 6 of the records (43%). Other recurring categories include Missing Authorization, Authorization Bypass Through User-Controlled Key.
Every one of the 14 issues recorded for Permalink Manager Lite has a vendor fix available, so running the current release closes all known holes.
11 independent researchers contributed these findings, most of them (3) reported by Muhammad Zeeshan (Xib3rR4dAr). Permalink Manager Lite is installed on roughly 100,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2022-4021Permalink Manager Lite <= 2.2.20.1 - Cross-Site Request Forgery
Read the full analysisVulnerability Records

Permalink Manager Lite
Author
Maciej Bis
The native WordPress permalink system is designed to be simple and easy to configure. Permalink Manager extends it and allows you to define custom URL structures and edit individual permalinks exactly the way you want. The free version lets you manage URLs for posts, pages, and custom post types, while the Pro version also includes support for categories, tags, and custom taxonomies. Documentation | Buy Permalink Manager Pro The plugin supports all custom post types and taxonomies, and it is compatible with popular plugins like WooCommerce, Yoast SEO, WPML, and Polylang. Permalink Manager automatically redirects original and duplicate URLs to the correct page. Using the canonical redirect, it prevents the broken links that can hurt the UX and SEO, potentially causing a drop in organic traffic. Features Change Single Permalinks For a consistent and SEO-friendly URL structure, you may customize and change the permalink of each post, page, and custom post type item. Categories, tags & custom taxonomies terms permalinks can be edited in Permalink Manager Pro. Customize URL Formats Using the “Permastructures” settings, you can choose the default format for custom URLs using “Permastructures” settings. The new format will be applied automatically when a new post/term is added or once the old permalinks are regenerated. Custom Post Types Support Choose the post types and taxonomies you want to customize and exclude the rest of them. The plugin supports post types and taxonomies managed with ACF, Pods, JetEngine, Toolset Types, and other plugins. Translate Permalinks With WPML or Polylang active, Permalink Manager allows you to translate the slug and customize the URL structure for every language separately. Remove Parent Slugs Remove parent slugs from your WordPress URLs organize them hierarchically by adding categories to custom permalinks, all without writing a single line of code. Canonical Redirect Automatically redirect old URLs whenever they change, preventing broken links, and protecting your site’s search visibility. Additional features available in Permalink Manager Pro The free version covers all the necessary functions, while the premium version adds a few handy functionalities that can improve the process of adjusting WordPress permalinks. Click here for additional information and to purchase Permalink Manager Pro. Custom Taxonomies Support Taxonomies are fully supported in the premium version (categories, tags & custom taxonomies). You may adjust individual term permalinks or change them all at once using “Permastructures”. Full WooCommerce Support Permalink Manager Pro may be used to change the URL addresses of WooCommerce products, tags, categories, and attributes. For example, you may use the plugin to remove /product/ and /product-category/ from WooCommerce URL. Custom Fields Support Permalink Manager is the only actively supported WordPress plugin that allows to add custom fields to permalinks and requires no technical experience. Extra Redirects Define extra redirects (aliases) for any post, page, or term. Additionally, you may assign a redirect URL to each post/term, which will take users to any external URL address. REST API Support Access and manage custom permalinks via the REST API.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C