CVE-2026-8494 is a stored cross-site scripting vulnerability in the Permalink Manager Lite plugin for WordPress. It affects all versions up to and including 2.5.3.3 due to improper neutralization of input during web page generation, specifically insufficient escaping of post titles in the admin URI Editor interface. Authenticated attackers with Contributor-level privileges or higher can inject arbitrary scripts that execute in the context of the administrator's browser when accessing the Permalink Manager page. This vulnerability can lead to partial confidentiality and integrity impacts but does not affect availability. No vendor advisory or patch information is currently available.

An attacker with Contributor-level access or higher can inject malicious scripts that execute in an administrator's browser when they access the Permalink Manager page. This can lead to partial compromise of confidentiality and integrity of the administrator's session or data within the affected interface. There is no impact on availability. The vulnerability requires authentication and user interaction (administrator visiting the page).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit Contributor-level access to trusted users only and monitor for suspicious activity related to the Permalink Manager plugin. Consider disabling or restricting access to the Permalink Manager admin interface if possible.