CVE-2026-120114 qriouslad CVE debrief

Who should care

Site administrators and defenders using the Debug Log Manager plugin for WordPress should assess their exposure and take necessary actions to protect their sites. This includes verifying if the site uses the vulnerable plugin version, checking if debug logging is enabled with JS error logging active, assessing the ability of attackers to obtain the dlmVars.jsErrorLogging nonce, and applying patches or mitigations provided by the vendor.

Why it matters

CVE-2026-120114 is a Stored Cross-Site Scripting vulnerability in the Debug Log Manager WordPress plugin. Defenders should verify if their site uses the vulnerable plugin version, assess exposure, and apply patches or mitigations. The vulnerability allows attackers to inject web scripts when specific conditions are met, requiring defenders to prioritize verification and remediation efforts.

• Attackers can inject arbitrary web scripts, potentially leading to user interactions being manipulated.
• Successful exploitation requires specific conditions to be met, limiting the attack surface.
• Defenders need to verify plugin versions and configurations to assess exposure.
• Remediation involves patching or mitigating the vulnerability in the plugin.

Technical summary

The Debug Log Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message (and pageUrl)' parameter in all versions up to, and including, 2.5.2. This is due to insufficient input sanitization and output escaping. An attacker can inject arbitrary web scripts in pages that will execute when a user accesses an injected page. However, successful exploitation requires the site administrator to have debug logging enabled with JS error logging active and for the attacker to obtain the publicly emitted dlmVars.jsErrorLogging nonce.

Defensive priority

Defenders should prioritize verifying if their site uses the vulnerable plugin version and enable JS error logging, assess exposure, and apply patches or mitigations.

Recommended defensive actions

• Verify if the site uses the vulnerable Debug Log Manager plugin version 2.5.2 or earlier.
• Check if debug logging is enabled with JS error logging active.
• Assess the ability of attackers to obtain the dlmVars.jsErrorLogging nonce.
• Apply patches or mitigations provided by the vendor.
• Monitor for suspicious activity related to the plugin.

Evidence notes

The vulnerability allows for Stored Cross-Site Scripting via the 'message (and pageUrl)' parameter due to insufficient input sanitization and output escaping. Successful exploitation requires debug logging to be enabled with JS error logging active and obtaining the dlmVars.jsErrorLogging nonce.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.