Stored cross-site scripting in Debug Log Manager WordPress plugin
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The Debug Log Manager plugin for WordPress through 2.5.2 does not properly sanitize or escape the message and pageUrl parameters, a case of improper neutralization of input during web page generation (CWE-79). An unauthenticated attacker can store arbitrary web scripts that run in the browser of any user who opens an affected page. Exploitation requires that the site has debug logging and JS error logging enabled, and the attacker must obtain the nonce that the plugin publishes on every frontend page.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message (and pageUrl)' parameter in all versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that the site administrator has debug logging enabled with JS error logging active, and that the attacker can obtain the publicly emitted dlmVars.jsErrorLogging nonce — which is broadcast on every frontend page — to pass the nonce check on the unauthenticated endpoint.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for Debug Log Manager (Conveniently Monitor and Inspect Errors).
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Timeline
- 2026-10-31 Threatist record created from CVE-2026-120114
- 2026-10-31 Alias added: GHSA-36wm-h889-8m5h
- 2026-11-01 Priority changed: MEDIUM → LOW
- 2026-11-01 CISA SSVC decision points changed
References
Other 8
- https://www.wordfence.com/threat-intel/vulnerabilities/id/904181bc-fd56-4296-9c59-532bbc272abd?source=cve
- https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.5.2/classes/class-debug-log.php#L519
- https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.5.2/classes/class-debug-log.php#L1605
- https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.5.2/classes/class-debug-log.php#L1728
- https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.5.2/classes/class-debug-log.php#L2158
- https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.5.2/bootstrap.php#L134
- https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.5.2/bootstrap.php#L567
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3754121%40debug-log-manager&new=3754121%40debug-log-manager
More qriouslad vulnerabilities
- TI-2024-10291 System Dashboard < 2.8.15 - Unauthenticated Stored XSS CVSS 3.1MEDIUM 6.1
- TI-2023-06630 System Dashboard < 2.8.10 - XSS via Header Injection CVSS 3.1MEDIUM 5.4
- TI-2024-09923 System Dashboard < 2.8.15 - Admin+ Path Traversal CVSS 3.1MEDIUM 4.9
- TI-2023-05859 Debug Log Manager < 2.3.0 - Sensitive Logs Exposure CVSS 3.1HIGH 7.5
- TI-2024-23538 WordPress Debug Log Manager plugin <= 2.3.1 - Broken Access Control vulnerability CVSS 3.1HIGH 8.8
- TI-2025-03359 Debug Log Manager <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting CVSS 3.1HIGH 7.2
Sources
- CVE-2026-120114 · CVE Program
- CVE-2026-120114 · NVD
- FIRST EPSS
- GHSA-36wm-h889-8m5h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences