A forgery trick allows an attacker to inject arbitrary permalink data without authentication. Based on the description, it is inferred that the injected script would execute in the browser context of a privileged user, turning a simple form submission into a storage-time XSS vector. The weakness is a classic CSRF flaw (CWE‑352).

The vulnerability affects WordPress sites running the BeRocket "Permalink Manager for WooCommerce" plugin in any version up to and including 1.0.8.2. All installations of these plugin versions are exposed.

The CVSS score of 7.1 indicates a high severity. The EPSS score of <1% suggests a very low but non‑zero probability of exploitation. The flaw is not listed in the CISA KEV catalog. Because it is unauthenticated CSRF, an attacker can trigger the exploit by enticing a user to visit a crafted link or by embedding the request in a trusted page. Once the script is stored, it executes automatically for a privileged user—even though that is inferred from the nature of stored XSS.