CVE-2024-29092: Permalink Manager Lite XSS Vulnerability

CVE-2024-29092 Overview

CVE-2024-29092 is a reflected cross-site scripting (XSS) vulnerability in the Maciej Bis Permalink Manager Lite WordPress plugin. The flaw stems from improper neutralization of user input during web page generation, classified as [CWE-79]. All versions of Permalink Manager Lite up to and including 2.4.3 are affected. Attackers can craft malicious URLs that, when clicked by an authenticated or unauthenticated user, execute arbitrary JavaScript in the victim's browser session. The vulnerability requires user interaction and operates across a changed security scope, enabling impact beyond the vulnerable component.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the victim's browser, enabling session hijacking, credential theft, or redirection to malicious sites hosted outside the WordPress environment.

Affected Products

Maciej Bis Permalink Manager Lite (WordPress plugin)
All versions from n/a through 2.4.3
WordPress sites with the plugin installed and active

Discovery Timeline

2024-03-19 - CVE-2024-29092 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29092

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw in the Permalink Manager Lite plugin for WordPress. The plugin fails to properly sanitize or encode user-supplied input before reflecting it back into HTML responses. An attacker who tricks a user into clicking a crafted URL can execute arbitrary JavaScript in that user's browser context.

Because the CVSS vector indicates a changed scope with required user interaction, exploitation depends on social engineering such as phishing emails or malicious links. The impact extends beyond the vulnerable component, affecting the broader WordPress session and any accessible browser state. EPSS data places the exploitation probability at 0.398% (percentile 32.098).

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The plugin accepts request parameters and writes them into the response without applying context-appropriate output encoding or input validation. HTML control characters and script delimiters pass through unchanged, allowing injected markup to be parsed as executable code by the browser.

Attack Vector

An attacker crafts a URL containing a malicious JavaScript payload within a vulnerable parameter handled by Permalink Manager Lite. The attacker delivers the URL through phishing, forum posts, or embedded links on third-party sites. When a victim visits the URL on a site running the affected plugin, the server reflects the payload into the response page. The browser executes the injected script in the context of the WordPress site.

Technical details of the specific vulnerable parameter are described in the Patchstack Vulnerability Advisory.

Detection Methods for CVE-2024-29092

Indicators of Compromise

Web server access logs containing request parameters with <script>, javascript:, onerror=, or encoded script delimiters targeting Permalink Manager Lite endpoints
Referrer headers pointing to attacker-controlled domains preceding WordPress admin or content pages
Anomalous outbound requests from browsers to unknown domains after users visit WordPress pages
WordPress sites running Permalink Manager Lite version 2.4.3 or earlier

Detection Strategies

Inspect HTTP request parameters for unencoded HTML or JavaScript patterns reaching the plugin's handlers
Deploy a web application firewall (WAF) rule set that blocks reflected XSS payloads against WordPress plugin endpoints
Correlate browser-side script errors with server-side request logs to identify reflected payloads

Monitoring Recommendations

Monitor WordPress plugin version inventory for installations of Permalink Manager Lite at or below 2.4.3
Alert on URL parameters containing script tags, event handlers, or URL-encoded equivalents
Track user reports of unexpected redirects, pop-ups, or credential prompts on WordPress-hosted pages

How to Mitigate CVE-2024-29092

Immediate Actions Required

Identify all WordPress sites running Permalink Manager Lite and determine the installed version
Update the plugin to a version later than 2.4.3 once the vendor releases a patched release
Review the Patchstack Vulnerability Advisory for vendor guidance
Educate administrators and content editors about the risk of clicking untrusted links

Patch Information

The vulnerability affects Permalink Manager Lite versions up to and including 2.4.3. Site administrators should consult the Patchstack advisory and the WordPress plugin repository for the latest patched release and apply it through the standard WordPress plugin update workflow.

Workarounds

Deactivate and remove Permalink Manager Lite until a patched version is available if the plugin is not essential
Deploy a WAF with rules that block reflected XSS patterns targeting WordPress query parameters
Enforce a strict Content Security Policy (CSP) that restricts inline script execution and limits allowed script sources
Set the HttpOnly and Secure flags on session cookies to reduce the impact of script-based session theft

bash

# Example Content Security Policy header for WordPress (via .htaccess)
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Header set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options "nosniff"