« Volver al listado

CVE-2022-0201

Estado: ModificadaMedia (6.1)—

The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escape query parameters before outputting them back in the debug page, leading to a Reflected Cross-Site Scripting issue

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Permalink Manager Lite Project — Permalink Manager LitePermalink Manager Project — Permalink Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-0201",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "contact@wpscan.com",
      "affectedData": [
        {
          "vendor": "Maciej Bis",
          "product": "Permalink Manager Lite",
          "versions": [
            {
              "status": "affected",
              "version": "2.2.15",
              "lessThan": "2.2.15",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Maciej Bis",
          "product": "Permalink Manager Pro",
          "versions": [
            {
              "status": "affected",
              "version": "2.2.15",
              "lessThan": "2.2.15",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-02-14T12:15:16.373",
  "references": [
    {
      "url": "https://plugins.trac.wordpress.org/changeset/2656512",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "contact@wpscan.com"
    },
    {
      "url": "https://wpscan.com/vulnerability/f274b0d8-74bf-43de-9051-29ce36d78ad4",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "contact@wpscan.com"
    },
    {
      "url": "https://plugins.trac.wordpress.org/changeset/2656512",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wpscan.com/vulnerability/f274b0d8-74bf-43de-9051-29ce36d78ad4",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "contact@wpscan.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escape query parameters before outputting them back in the debug page, leading to a Reflected Cross-Site Scripting issue"
    },
    {
      "lang": "es",
      "value": "El plugin Permalink Manager Lite de WordPress versiones anteriores a 2.2.15 y el plugin Permalink Manager Pro de WordPress versiones anteriores a 2.2.15, no sanean ni escapan los parámetros query antes de devolverlos a la página de depuración, conllevando a un problema de tipo Cross-Site Scripting Reflejado"
    }
  ],
  "lastModified": "2026-06-17T04:20:08.457",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:permalink_manager_lite_project:permalink_manager_lite:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CC1ACBE2-EF61-438A-848F-DE09F490C829",
              "versionEndExcluding": "2.2.15"
            },
            {
              "criteria": "cpe:2.3:a:permalink_manager_project:permalink_manager:*:*:*:*:pro:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "048A3A5A-5034-443D-B391-1D3F2B84BED7",
              "versionEndExcluding": "2.2.15"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "contact@wpscan.com"
}