CVE-2022-0201

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escape query parameters before outputting them back in the debug page, leading to a Reflected Cross-Site Scripting issue

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Maciej Bis	Permalink Manager Lite	>= 2.2.15, < 2.2.15
Maciej Bis	Permalink Manager Pro	>= 2.2.15, < 2.2.15

References

https://plugins.trac.wordpress.org/changeset/2656512Patch, Third Party Advisory
https://wpscan.com/vulnerability/f274b0d8-74bf-43de-9051-29ce36d78ad4Exploit, Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2656512Patch, Third Party Advisory
https://wpscan.com/vulnerability/f274b0d8-74bf-43de-9051-29ce36d78ad4Exploit, Third Party Advisory

Timeline

Published: Feb 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-02035.3Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2.CVE-2022-02048.8A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially craft CVE-2022-02055.4The YOP Poll WordPress plugin before 6.3.5 does not sanitise and escape some of the settings (available to users with a role as low as autho CVE-2022-02066.1The NewStatPress WordPress plugin before 1.3.6 does not properly escape the whatX parameters before outputting them back in attributes, lead CVE-2022-02074.7A race condition was found in vdsm. Functionality to obfuscate sensitive values in log files that may lead to values being stored in clear t CVE-2022-02086.1The MapPress Maps for WordPress plugin before 2.73.4 does not sanitise and escape the mapid parameter before outputting it back in the "Bad CVE-2022-02094.8The Mitsol Social Post Feed WordPress plugin before 1.11 does not escape some of its settings before outputting them back in attributes, whi CVE-2022-02104.8The Random Banner WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the category parameter foun CVE-2022-02114.8The Shield Security WordPress plugin before 13.0.6 does not sanitise and escape admin notes, which could allow high privilege users to perfo CVE-2022-02126.1The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page CVE-2022-02136.6vim is vulnerable to Heap-based Buffer Overflow CVE-2022-02147.5The Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages, as such data can be sent by unauthentica