# CVE-2026-57758: BeRocket Permalink Manager for WooCommerce CSRF to Stored XSS

Source: https://junglewise.ai/threats/cve-2026-57758-berocket-permalink-manager-for-woocommerce-csrf-to-stored-xss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-02. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-57758 · Severity: high · CVSS 7.1 · Published 2026-07-02

A vulnerability exists in the Permalink Manager for WooCommerce plugin, which is used to customize website link structures for online stores. An attacker could trick a site administrator into performing unintended actions, such as changing site settings or injecting malicious scripts, by getting them to click a specially crafted link. This could lead to unauthorized changes to the store's configuration or the compromise of administrative accounts.

Vendors: [BeRocket](https://junglewise.ai/threats/vendors/berocket).

## Quick answers

**Is CVE-2026-57758 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57758 being exploited in the wild.

**How severe is CVE-2026-57758?** High severity, with a CVSS score of 7.1, published 2 July 2026.

**Which products and versions are affected?** BeRocket Permalink Manager for WooCommerce <= 1.0.8.2.

**Is there a fix for CVE-2026-57758?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-57758 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57758?** Check whether you run BeRocket Permalink Manager for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the BeRocket Permalink Manager for WooCommerce plugin through version 1.0.8.2. The issue stems from a lack of proper nonce validation on sensitive administrative functions, allowing an unauthenticated attacker to craft a malicious request. If a logged-in administrator interacts with a malicious link or page, the attacker can trigger actions on their behalf, potentially leading to Stored Cross-Site Scripting (XSS). As of the advisory date, no official patch has been released, and users are advised to exercise caution with administrative sessions.

## Affected products

- BeRocket Permalink Manager for WooCommerce <= 1.0.8.2

## Timeline

- 2026-05-10: disclosed: Reported by dodoh4t
- 2026-07-02: advisory: Published by Patchstack and NVD

## References

- [https://patchstack.com/database/wordpress/plugin/permalink-manager-for-woocommerce/vulnerability/wordpress-permalink-manager-for-woocommerce-plugin-1-0-8-2-csrf-to-stored-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/permalink-manager-for-woocommerce/vulnerability/wordpress-permalink-manager-for-woocommerce-plugin-1-0-8-2-csrf-to-stored-xss-vulnerability?_s_id=cve)