Permalink Manager Lite

Permalink Manager Lite has 14 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 14 are fixed as of October 2026. Their average CVSS score is 6.1, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high. 2024 was the busiest year with 6 disclosures.

The most common weakness is Cross-Site Scripting, behind 6 of the records (43%). Other recurring categories include Missing Authorization, Authorization Bypass Through User-Controlled Key.

Every one of the 14 issues recorded for Permalink Manager Lite has a vendor fix available, so running the current release closes all known holes.

11 independent researchers contributed these findings, most of them (3) reported by Muhammad Zeeshan (Xib3rR4dAr). Permalink Manager Lite is installed on roughly 100,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

01234567891009.01.2016Today27.09.20217.2Permalink Manager Lite <= 2.2.12 - Admin+ SQL Injection CVSS 7.2 · 27.09.202117.01.20226.1Permalink Manager Lite <= 2.2.14 Reflected Cross-Site Scripting CVSS 6.1 · 17.01.202201.11.20226.5Permalink Manager Lite <= 2.2.20 - Missing Authorization CVSS 6.5 · 01.11.202216.11.20228.8Permalink Manager Lite <= 2.2.20.1 - Cross-Site Request Forgery CVSS 8.8 · 16.11.202214.12.20226.4Permalink Manager Lite <= 2.2.20.3 - Authenticated Stored Cross-Site Scripting CVSS 6.4 · 14.12.202215.03.20246.1Permalink Manager Lite <= 2.4.3 - Reflected Cross-Site Scripting CVSS 6.1 · 15.03.202418.03.20245.4Permalink Manager <= 2.4.3.1 - Missing Authorization to Authenticated(Author+) Arbitrary Post Slug Modification CVSS 5.4 · 18.03.202420.03.20246.1Permalink Manager Lite and Permalink Manager Pro <= 2.4.3.1 - Reflected Cross-Site Scripting CVSS 6.1 · 20.03.20244.3Plugin Permalink <= 2.4.3.1 - Missing Authorization via get_uri_editor CVSS 4.3 · 20.03.202427.06.20246.1Permalink Manager Lite <= 2.4.3.3 - Reflected Cross-Site Scripting CVSS 6.1 · 27.06.202427.08.20245.3Permalink Manager Lite <= 2.4.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure CVSS 5.3 · 27.08.202406.09.20255.3Permalink Manager Lite <= 2.5.1.3 - Unauthenticated Sensitive Information Exposure CVSS 5.3 · 06.09.202525.02.20265.3Permalink Manager Lite < 2.5.3 - Missing Authorization CVSS 5.3 · 25.02.202616.06.20266.4Permalink Manager Lite <= 2.5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title CVSS 6.4 · 16.06.2026

Strategic Overview

Avg CVSSMedium
6.1/ 10
Patch Coverage100%
Open

0

Fixed

14

Get automatic notifications for all Permalink Manager Lite vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2022-4021

Permalink Manager Lite <= 2.2.20.1 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

14 records
2026-06-16 17:40CVE-2026-8494
6.4
Medium
Ahmad MarzoukYes
2026-02-25 00:00CVE-2026-32413
5.3
Medium
hhhaiYes
2025-09-06 00:00CVE-2025-59010
5.3
Medium
Que Thanh Tuan - Blue RockYes
2024-08-27 00:00CVE-2024-8195
5.3
Medium
stealthcopterYes
2024-06-27 00:00CVE-2024-37257
6.1
Medium
Rafie MuhammadYes
2024-03-20 00:00CVE-2024-2738
6.1
Medium
Muhammad Zeeshan (Xib3rR4dAr)Yes
2024-03-20 00:00CVE-2024-2543
4.3
Medium
Muhammad Zeeshan (Xib3rR4dAr)Yes
2024-03-18 00:00CVE-2024-2538
5.4
Medium
Muhammad Zeeshan (Xib3rR4dAr)Yes
2024-03-15 00:00CVE-2024-29092
6.1
Medium
Rafie MuhammadYes
2022-12-14 00:00CVE-2022-4410
6.4
Medium
Nicole SheininYes
Showing 1–10 of 14 reports
Permalink Manager Lite banner
Latestv2.6.1

Permalink Manager Lite

Maciej Bis

Author

Maciej Bis

4.8(176)
96/100
Last Updated
2026-10-13 (15d ago)
Active Installs
100,000+
Downloads
3,107,236
Requires WP
5.3.0+
Requires PHP
5.4+
Tested up to
WP 7.1.3
Created
2016-01-09 (11y ago)

Permalink Manager gives you more control over WordPress URLs, allowing you to customize URLs directly from the admin dashboard without requiring custom code. You can define a custom permalink structure for any content type or edit individual permalinks separately. The plugin supports all custom post types and taxonomies and works with popular plugins such as WooCommerce, ACF, WPML, and Polylang. The free version lets you customize permalinks for posts, pages, and custom post types. With the Pro version, you can also manage permalinks for categories, tags, and custom taxonomies. Permalink Manager automatically redirects old and duplicate URLs to the correct page, helping prevent broken links and 404 errors. Buy Permalink Manager Pro | Quickstart guide | Documentation What You Can Do With Permalink Manager Change Single Permalinks For a consistent and SEO-friendly URL structure, you may customize and change the permalink of each post, page, and custom post type item. Categories, tags & custom taxonomies terms permalinks can be edited in Permalink Manager Pro. Customize URL Formats The Permastructures settings let you override the default permalink structure and define a custom URL format using available tags, including %custom_post_type% and %custom_taxonomy%. Remove the Post Type or Taxonomy Slug The plugin lets you remove the base slug, such as /portfolio/ or /event/, from custom post type and taxonomy URLs. Add Taxonomies to CPT URLs Add category-based permalinks to posts and custom post types, with support for primary categories set in your SEO plugin. Translate Permalinks With WPML or Polylang active, Permalink Manager allows you to translate slugs and use a different URL structure for each language. Control Parent Slugs Remove or keep parent slugs in permalinks for pages and other hierarchical post types. Additional Features Available in Permalink Manager Pro The free version includes all the essential features. Permalink Manager Pro adds full support for custom taxonomies and WooCommerce, along with a few additional functionalities. See all Pro features. Custom Taxonomies Support Taxonomies are fully supported in the premium version (categories, tags & custom taxonomies). You may adjust individual term permalinks or change them all at once using “Permastructures”. Full WooCommerce Support Permalink Manager Pro may be used to change the URL addresses of WooCommerce products, tags, categories, and attributes. For example, you can remove /product/ and /product-category/ from WooCommerce URLs or add SKUs to product permalinks. Custom Fields Support Add custom field values to your URLs from ACF and other custom field plugins, with no coding required. Extra Redirects Define extra redirects (aliases) for any post, page, or term. Additionally, you may assign a redirect URL to each post/term, which will take users to any external URL address. REST API Read and update custom permalinks and redirects through the WordPress REST API.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C