This vulnerability resides in the Permalink Manager Lite WordPress plugin and allows an authenticated user with author-level or higher privileges to inject arbitrary HTML or JavaScript into the "slug" field of a post. Because the plugin fails to sanitize and escape the slug value properly, the payload is retained in the database and later rendered without filtering whenever an administrator or other privileged user opens the URI Editor admin page. The stored script executes in the context of the compromised account, enabling the attacker to steal session cookies, deface content, or perform other in‑browser malicious actions. The weakness is reflected in CWE‑79.

All installations of the "Permalink Manager Lite" plugin for WordPress running version 2.6.1 or earlier are affected. Upgrading to a later release that removes the faulty input handling mitigates the flaw.

The vulnerability carries a CVSS score of 6.4, indicating a moderate severity. Exploitation requires the attacker to be authenticated with author-level or higher permissions and to submit a percent‑encoded JavaScript payload via the REST API. The EPSS score is not provided, and the issue is not currently listed in the CISA KEV catalogue, suggesting that while the risk is real, widespread exploitation has not yet been observed. Nonetheless, the attack path is straightforward for any user who can perform post edits, making the exposure significant for sites with active author accounts.