CVE-2022-4410: Permalink Manager Lite <= 2.2.20.3 - Authenticated Stored Cross-Site Scripting
The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including 2.2.20.3 due to improper output escaping on post/page/media titles. This makes it possible for attackers to inject arbitrary web scripts on the permalink-manager page if another plugin or theme is installed on the site that allows lower privileged users with unfilteredhtml the ability to modify post/page titles with malicious web scripts.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-4410?
The severity of CVE-2022-4410 is considered medium, as it allows for stored cross-site scripting attacks.
How do I fix CVE-2022-4410?
To fix CVE-2022-4410, update the Permalink Manager Lite plugin to version 2.2.20.4 or later.
What can an attacker do with CVE-2022-4410?
An attacker can inject arbitrary web scripts into the permalink-manager page, potentially compromising user data.
Which versions of the Permalink Manager Lite are affected by CVE-2022-4410?
CVE-2022-4410 affects all versions of the Permalink Manager Lite plugin up to and including 2.2.20.3.
Is CVE-2022-4410 specific to WordPress?
Yes, CVE-2022-4410 specifically affects the Permalink Manager Lite plugin for WordPress.