Input validation vulnerability in Permalinks Customizer 2.8.2

The Permalinks Customizer plugin for WordPress is vulnerable to a form of attack called Reflected Cross-Site Scripting. This means attackers can inject malicious code into webpages, which can be executed if they can successfully trick a user into clicking on a link or taking some other action. All versions of the plugin up to and including 2.8.2 are affected, because they do not have sufficient protections for preventing and removing malicious code.