Permalink Manager Lite
Permalink Manager Lite has 14 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 14 are fixed as of October 2026. Their average CVSS score is 6.1, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high. 2024 was the busiest year with 6 disclosures.
The most common weakness is Cross-Site Scripting, behind 6 of the records (43%). Other recurring categories include Missing Authorization, Authorization Bypass Through User-Controlled Key.
Every one of the 14 issues recorded for Permalink Manager Lite has a vendor fix available, so running the current release closes all known holes.
11 independent researchers contributed these findings, most of them (3) reported by Muhammad Zeeshan (Xib3rR4dAr). Permalink Manager Lite is installed on roughly 100,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2022-4021Permalink Manager Lite <= 2.2.20.1 - Cross-Site Request Forgery
Read the full analysisVulnerability Records

Permalink Manager Lite
Author
Maciej Bis
Permalink Manager gives you more control over WordPress URLs, allowing you to customize URLs directly from the admin dashboard without requiring custom code. You can define a custom permalink structure for any content type or edit individual permalinks separately. The plugin supports all custom post types and taxonomies and works with popular plugins such as WooCommerce, ACF, WPML, and Polylang. The free version lets you customize permalinks for posts, pages, and custom post types. With the Pro version, you can also manage permalinks for categories, tags, and custom taxonomies. Permalink Manager automatically redirects old and duplicate URLs to the correct page, helping prevent broken links and 404 errors. Buy Permalink Manager Pro | Quickstart guide | Documentation What You Can Do With Permalink Manager Change Single Permalinks For a consistent and SEO-friendly URL structure, you may customize and change the permalink of each post, page, and custom post type item. Categories, tags & custom taxonomies terms permalinks can be edited in Permalink Manager Pro. Customize URL Formats The Permastructures settings let you override the default permalink structure and define a custom URL format using available tags, including %custom_post_type% and %custom_taxonomy%. Remove the Post Type or Taxonomy Slug The plugin lets you remove the base slug, such as /portfolio/ or /event/, from custom post type and taxonomy URLs. Add Taxonomies to CPT URLs Add category-based permalinks to posts and custom post types, with support for primary categories set in your SEO plugin. Translate Permalinks With WPML or Polylang active, Permalink Manager allows you to translate slugs and use a different URL structure for each language. Control Parent Slugs Remove or keep parent slugs in permalinks for pages and other hierarchical post types. Additional Features Available in Permalink Manager Pro The free version includes all the essential features. Permalink Manager Pro adds full support for custom taxonomies and WooCommerce, along with a few additional functionalities. See all Pro features. Custom Taxonomies Support Taxonomies are fully supported in the premium version (categories, tags & custom taxonomies). You may adjust individual term permalinks or change them all at once using “Permastructures”. Full WooCommerce Support Permalink Manager Pro may be used to change the URL addresses of WooCommerce products, tags, categories, and attributes. For example, you can remove /product/ and /product-category/ from WooCommerce URLs or add SKUs to product permalinks. Custom Fields Support Add custom field values to your URLs from ACF and other custom field plugins, with no coding required. Extra Redirects Define extra redirects (aliases) for any post, page, or term. Additionally, you may assign a redirect URL to each post/term, which will take users to any external URL address. REST API Read and update custom permalinks and redirects through the WordPress REST API.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C