WordPress Permalink Manager Lite Stored XSS Vulnerability (CVE-2026-8494)

Vulnerability Overview Vulnerability Name: Permalink Manager Lite <= 2.5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title CVE ID: CVE-2026-8494 CVSS Score: 6.4 (Medium) Publication Date: June 16, 2026 Last Updated Date: June 17, 2026 Researcher: Ahmad Marzouk Impact Scope Software Type: Plugin Software Name: Permalink Manager Lite Affected Versions: <= 2.5.3.3 Fixed Version: 2.5.3.4 or later Remediation Recommendation: Update to version 2.5.3.4 or later. Additional Information Vulnerability Description: The Permalink Manager Lite plugin contains a stored cross-site scripting (XSS) vulnerability in the WordPress admin URI Editor interface, affecting all versions up to 2.5.3.3. Due to insufficient output escaping, attackers can inject arbitrary web scripts that execute when an administrator visits the Permalink Manager page. References: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org Recent Vulnerabilities List Additional Resources Wordfence Intelligence: Provides a free WordPress vulnerability database for personal and commercial use. API Access: Offers free API access to retrieve the latest vulnerability information. Documentation: Provides detailed API documentation and webhook configuration guides. Contact Information Support Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 365 days/year, 1-hour response time Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved License: Used under the terms of the MITRE and Defiant Inc. licenses. Social Media Facebook: Wordfence Twitter: Wordfence LinkedIn: Wordfence Instagram: Wordfence Subscription Subscription: Subscribe to Wordfence news and updates to receive the latest security information. Footer Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Miscellaneous Terms of Service: Terms of Service Privacy Policy: Privacy Policy Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Summary This page details a stored cross-site scripting vulnerability (CVE-2026-8494) in the Permalink Manager Lite plugin, affecting versions <= 2.5.3.3. It is recommended to update to version 2.5.3.4 or later to remediate the vulnerability. The page also provides information on other related vulnerabilities and resources from Wordfence Intelligence.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Permalink Manager Lite Stored XSS Vulnerability (CVE-2026-8494)

More from this source