Debug Log Manager <= 2.5.0 - Unauthenticated Improper Output Neutralization for Logs via log_js_errors AJAX Action
| CVE | CVE-2026-9016 |
|---|---|
| CVSS | 5.3 (Medium) |
| Publicly Published | June 5, 2026 |
| Last Updated | June 6, 2026 |
| Researcher |
Endang Alfarisi
|
Description
The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Improper Output Neutralization for Logs in all versions up to, and including, 2.5.0. This is due to the `log_js_errors()` AJAX handler being registered for unauthenticated users via `wp_ajax_nopriv_log_js_errors` and gated only by a nonce that is publicly disclosed in every front-end page's HTML through `wp_localize_script()` whenever JavaScript error logging is enabled, providing no real authorization barrier. This makes it possible for unauthenticated attackers to inject arbitrary forged entries into the site's WordPress debug log by supplying attacker-controlled values for the `message`, `script`, `lineNo`, `columnNo`, and `pageUrl` fields — enabling spoofing of error and incident records, obscuring malicious activity within fabricated log noise, and misleading administrators who rely on the log for triage. This vulnerability is only exploitable when the plugin's JavaScript error logging feature is enabled, as the requisite nonce is only published into the page HTML under that condition.
References
- plugins.trac.wordpress.org
- plugins.trac.wordpress.org
- plugins.trac.wordpress.org
- plugins.trac.wordpress.org
- plugins.trac.wordpress.org
Share
Vulnerability Details for Debug Log Manager – Conveniently Monitor and Inspect Errors
| Software Type | Plugin |
|---|---|
| Software Slug | debug-log-manager (view on wordpress.org) |
| Patched? | Yes |
| Remediation | Update to version 2.5.1, or a newer patched version |
| Affected Version |
|
| Patched Version |
|
Recent vulnerabilities in Debug Log Manager – Conveniently Monitor and Inspect Errors
| # | Title | CVE ID | CVSS | Researchers | Date |
|---|---|---|---|---|---|
| 1 | Debug Log Manager <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting | CVE-2025-3809 | Yassine Neggaoui (Y45NG) | April 18, 2025 | |
| 2 | Debug Log Manager <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting | CVE-2025-32613 | Martino Spagnuolo | April 17, 2025 | |
| 3 | Debug Log Manager <= 2.3.1 - Missing Authorization | CVE-2024-35669 | Majed Refaea | June 3, 2024 | |
| 4 | Debug Log Manager <= 2.3.1 - Missing Authorization via toggle_debugging | CVE-2024-33915 | Dhabaleshwar Das | April 29, 2024 | |
| 5 | Debug Log Manager <= 2.3.1 - Unauthenticated Stored Cross-Site Scripting | CVE-2024-32582 | Majed Refaea | April 16, 2024 | |
| 6 | Debug Log Manager <= 2.2.2 - Directory Listing to Sensitive Information Disclosure | CVE-2023-6383 | Dmitrii Ignatyev | December 13, 2023 | |
| 7 | Debug Log Manager <= 2.2.0 - Cross-Site Request Forgery | CVE-2023-5772 | Dmitrii Ignatyev | November 29, 2023 | |
| 8 | Debug Log Manager <= 2.2.1 - Missing Authorization | CVE-2023-6136 | Dmitrii Ignatyev, Joshua Chan | November 23, 2023 |
This record contains material that is subject to copyright.
Copyright 2012-2026 Defiant Inc.
License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.
Copyright 1999-2026 The MITRE Corporation
License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.
Have information to add, or spot any errors? Contact us at wfi-support@wordfence.com so we can make any appropriate adjustments.
Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!
Learn moreWant to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.
The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.
Documentation