CVE-2026-97272: WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.13 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Premmerce Permalink Manager for WooCommerceto a version that resolves this vulnerability.Fixed in 2.3.16
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or other prior privileges. Exploitation requires user interaction.
Which installations are affected?
Premmerce Permalink Manager for WooCommerce versions 2.3.13 and earlier are affected. The provided data does not identify a fixed version or any configuration prerequisites.
What impact can successful exploitation have?
The issue is cross-site scripting with low confidentiality, integrity, and availability impact according to the supplied vector. Its scope is changed, meaning the impact can extend beyond the vulnerable component's security authority.