{"id":"CVE-2022-0201","state":"PUBLISHED","title":"Permalink Manager < 2.2.15 - Reflected Cross-Site Scripting","description":"The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escape query parameters before outputting them back in the debug page, leading to a Reflected Cross-Site Scripting issue","publishedAt":"2022-02-14T09:21:04.000Z","updatedAt":"2024-08-02T23:18:42.547Z","severity":null,"assigner":"WPScan","products":["Maciej Bis Permalink Manager Lite","Maciej Bis Permalink Manager Pro"],"affected":[{"vendor":"Maciej Bis","product":"Permalink Manager Lite","versions":[{"version":"2.2.15","status":"affected","lessThan":"2.2.15","versionType":"custom"}]},{"vendor":"Maciej Bis","product":"Permalink Manager Pro","versions":[{"version":"2.2.15","status":"affected","lessThan":"2.2.15","versionType":"custom"}]}],"references":["https://wpscan.com/vulnerability/f274b0d8-74bf-43de-9051-29ce36d78ad4","https://plugins.trac.wordpress.org/changeset/2656512"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T19:49:26.075Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/0xxx/CVE-2022-0201.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-0201","state":"PUBLISHED","datePublished":"2022-02-14T09:21:04.000Z","dateUpdated":"2024-08-02T23:18:42.547Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2022-01-12T00:00:00.000Z"},"containers":{"cna":{"title":"Permalink Manager < 2.2.15 - Reflected Cross-Site Scripting","descriptions":[{"lang":"en","value":"The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escape query parameters before outputting them back in the debug page, leading to a Reflected Cross-Site Scripting issue"}],"affected":[{"vendor":"Maciej Bis","product":"Permalink Manager Lite","versions":[{"version":"2.2.15","status":"affected","lessThan":"2.2.15","versionType":"custom"}]},{"vendor":"Maciej Bis","product":"Permalink Manager Pro","versions":[{"version":"2.2.15","status":"affected","lessThan":"2.2.15","versionType":"custom"}]}],"references":[{"url":"https://wpscan.com/vulnerability/f274b0d8-74bf-43de-9051-29ce36d78ad4","tags":["x_refsource_MISC"]},{"url":"https://plugins.trac.wordpress.org/changeset/2656512","tags":["x_refsource_CONFIRM"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Cross-site Scripting (XSS)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","dateUpdated":"2022-02-14T09:21:04.000Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81"},"credits":[{"lang":"en","value":"Krzysztof Zając"}],"source":{"discovery":"EXTERNAL"},"x_generator":"WPScan CVE Generator","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"contact@wpscan.com","ID":"CVE-2022-0201","STATE":"PUBLIC","TITLE":"Permalink Manager < 2.2.15 - Reflected Cross-Site Scripting"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Permalink Manager Lite","version":{"version_data":[{"version_affected":"<","version_name":"2.2.15","version_value":"2.2.15"}]}},{"product_name":"Permalink Manager Pro","version":{"version_data":[{"version_affected":"<","version_name":"2.2.15","version_value":"2.2.15"}]}}]},"vendor_name":"Maciej Bis"}]}},"credit":[{"lang":"eng","value":"Krzysztof Zając"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escape query parameters before outputting them back in the debug page, leading to a Reflected Cross-Site Scripting issue"}]},"generator":"WPScan CVE Generator","problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-79 Cross-site Scripting (XSS)"}]}]},"references":{"reference_data":[{"name":"https://wpscan.com/vulnerability/f274b0d8-74bf-43de-9051-29ce36d78ad4","refsource":"MISC","url":"https://wpscan.com/vulnerability/f274b0d8-74bf-43de-9051-29ce36d78ad4"},{"name":"https://plugins.trac.wordpress.org/changeset/2656512","refsource":"CONFIRM","url":"https://plugins.trac.wordpress.org/changeset/2656512"}]},"source":{"discovery":"EXTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://wpscan.com/vulnerability/f274b0d8-74bf-43de-9051-29ce36d78ad4","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://plugins.trac.wordpress.org/changeset/2656512","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T23:18:42.547Z"}}]}}}