CVE-2021-24769: Permalink Manager Lite Project Permalink Manager Lite

High severity, CVSS 7.2. EPSS: 1.4% chance of exploitation in the next 30 days.

The Permalink Manager Lite WordPress plugin before 2.2.13.1 does not validate and escape the orderby parameter before using it in a SQL statement in the Permalink Manager page, leading to a SQL Injection

Affected products

• Permalink Manager Lite Project Permalink Manager Lite: before 2.2.13.1 (fixed in 2.2.13.1)

Published 2021-10-25. Last modified 2026-06-17.