{"id":"CVE-2022-0201","aliases":["EUVD-2022-15404","GHSA-8pm6-f5wq-7x35"],"status":"published","title":"Permalink Manager \u003c 2.2.15 - Reflected Cross-Site Scripting","description":"The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escape query parameters before outputting them back in the debug page, leading to a Reflected Cross-Site Scripting issue","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03368,"percentile":0.88827,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2022-02-14T09:21:04Z","modified":"2026-06-17T04:20:08Z","exploits":[{"source":"nuclei","id":"CVE-2022-0201","title":"WordPress Permalink Manager \u003c2.2.15 - Cross-Site Scripting","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0201.yaml"}],"products":[{"vendor":"maciej bis","product":"permalink manager lite"},{"vendor":"maciej bis","product":"permalink manager pro"},{"vendor":"mbis","product":"permalink manager pro"},{"vendor":"permalink_manager_lite_project","product":"permalink_manager_lite"},{"vendor":"permalink_manager_project","product":"permalink_manager"}],"references":[{"url":"https://wpscan.com/vulnerability/f274b0d8-74bf-43de-9051-29ce36d78ad4","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://plugins.trac.wordpress.org/changeset/2656512","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0201"},{"url":"https://github.com/advisories/GHSA-8pm6-f5wq-7x35"}],"sources":{"cve":[{"id":"CVE-2022-0201","title":"Permalink Manager \u003c 2.2.15 - Reflected Cross-Site Scripting","description":"The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escape query parameters before outputting them back in the debug page, leading to a Reflected Cross-Site Scripting issue","status":"published","published":"2022-02-14T09:21:04Z","modified":"2024-08-02T23:18:42.547Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:41.34666Z"}],"euvd":[{"id":"EUVD-2022-15404","description":"The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escape query parameters before outputting them back in the debug page, leading to a Reflected Cross-Site Scripting issue","status":"published","published":"2022-02-14T09:21:04Z","modified":"2024-08-02T23:18:42Z","updated_at":"2026-11-03T03:26:06.080876Z"}],"ghsa":[{"id":"GHSA-8pm6-f5wq-7x35","title":"The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress...","description":"The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escape query parameters before outputting them back in the debug page, leading to a Reflected Cross-Site Scripting issue","status":"published","published":"2022-02-15T00:02:48Z","modified":"2023-02-03T05:05:45Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:53:47.32068Z"}],"nvd":[{"id":"CVE-2022-0201","description":"The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escape query parameters before outputting them back in the debug page, leading to a Reflected Cross-Site Scripting issue","status":"published","published":"2022-02-14T12:15:16.373Z","modified":"2026-06-17T04:20:08.457Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:12.155838Z"}]}}