The Slightly troublesome permalink WordPress plugin contains a Stored Cross‑Site Scripting flaw that allows malicious scripts to be saved and later served to site visitors. Any attacker who can submit data through the plugin’s input fields may store code that will then execute in the browsers of users who view the affected content.

The vulnerability affects the tmatsuur Slightly troublesome permalink plugin for all releases up through version 1.2.0, including earlier unspecified versions.

The CVSS score of 5.9 indicates a moderate risk level, while a low EPSS score of < 1% suggests that exploitation is uncommon in the wild. The plug‑in is not listed in CISA KEV. The likely attack vector involves an attacker entering malicious input via the plugin’s fields, which is stored unfiltered and later rendered, causing script execution in visitors’ browsers.