CVE-2026-8494

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in the admin URI Editor interface in all versions up to, and including, 2.5.3.3 due to insufficient output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in the admin Permalink Manager page that will execute whenever an administrator accesses the Permalink Manager page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 17, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-849416.9An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with CVE-2026-849428.7Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with d CVE-2026-849475.3undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length th CVE-2026-84959.8Missing Authorization vulnerability in Drupal Date iCal allows Forceful Browsing. This issue affects Date iCal: from 0.0.0 before 4.0.15.CVE-2026-84966.1A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version 5.12.7. A maliciously crafted ICS calendar invitation files allow CVE-2026-849606.1The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Query String in all versions u CVE-2026-849619.1undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as CVE-2026-849624.2An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls CVE-2026-849635.3An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value CVE-2026-849647.5A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that th CVE-2026-849655.5An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a fo CVE-2026-849665.5An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interp