CVE-2026-122222

Name of the Vulnerable Software and Affected Versions Permalink Manager Lite versions prior to 2.6.2

Description Insufficient input sanitization and output escaping allow authenticated attackers with author-level access and above to perform Stored Cross-Site Scripting (XSS). An attacker can submit a percent-encoded HTML or JavaScript payload through the slug parameter via the REST API. This payload is stored and subsequently executes in the browser session of an administrator when the URI Editor admin page is accessed.

Recommendations Update Permalink Manager Lite to version 2.6.2 or later.