CVE-2022-0201
Published: 14 February 2022
Summary
CVE-2022-0201 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Permalink Manager Lite Project Permalink Manager Lite. Its CVSS base score is 6.1 (Medium).
Operationally, ranked in the top 4.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The Permalink Manager Lite and Permalink Manager Pro WordPress plugins prior to version 2.2.15 contain a reflected cross-site scripting vulnerability. The root cause is a failure to sanitize or escape query parameters before echoing them into the plugin's debug page output, corresponding to CWE-79 and carrying a CVSS 3.1 score of 6.1.
An unauthenticated remote attacker can supply a crafted URL containing malicious script in one or more query parameters. When a logged-in administrator or other user visits the link, the payload executes in the victim's browser within the context of the affected WordPress site, enabling theft of session tokens, redirection, or other actions permitted by the user's privileges.
The referenced WordPress plugin repository changesets and WPScan advisory document the fix that was applied in release 2.2.15; site operators should update the plugin to that version or later to eliminate the reflected output of unsanitized parameters. The associated EPSS score has remained in the 0.18–0.20 range without a pronounced post-disclosure climb.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-15404
Vulnerability details
The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escape query parameters before outputting them back in the debug page, leading to a Reflected Cross-Site Scripting issue
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.