What is the CVSS score of CVE-2026-57350?

CVE-2026-57350 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of WP Debugging are affected by CVE-2026-57350?

The WP Debugging WordPress plugin (versions 2.12.2 and earlier) contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in users'…

How to fix or mitigate CVE-2026-57350?

Within 24 hours: Identify all WordPress installations running WP Debugging plugin versions ≤2.12.2; disable the plugin immediately and remove from production environments. Within 7 days: Implement Content Security Policy (CSP) headers to restrict inline script execution; review access and error logs for exploitation attempts; notify all affected users of the vulnerability and interim mitigations. Within 30 days: Monitor Patchstack and WordPress plugin registry for patched versions; conduct security audit of other installed WordPress plugins; evaluate alternative security monitoring solutions to replace WP Debugging functionality.

WP Debugging CVE-2026-57350

EUVD-2026-41349 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-v8f6-4wvm-6rp8

WordPress XSS Wordpress Plugin Wp Debugging

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Unauthenticated reflected XSS needs no privileges (PR:N) but requires victim interaction (UI:R); scope change (S:C) as script runs in browser context, low C/I impact and no availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:15 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in WP Debugging <= 2.12.2 versions.

AnalysisAI

Reflected cross-site scripting in the WP Debugging WordPress plugin (versions 2.12.2 and earlier) lets unauthenticated remote attackers inject arbitrary JavaScript that executes in a victim's browser after they interact with a crafted link or request. Reported by Patchstack and classified CWE-79 with a CVSS 7.1, the flaw carries a scope-change impact meaning injected script can affect the wider WordPress session context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

WP Debugging is a developer-oriented WordPress plugin (authored by Andy Fragen, per CPE cpe:2.3:a:andy_fragen:wp_debugging) that enables WordPress debug constants such as WP_DEBUG and related logging early in the load process. The vulnerability is a CWE-79 (Improper Neutralization of Input During Web Page Generation) issue: user-controllable input is reflected into HTML output without sufficient sanitization or output encoding, allowing HTML/JavaScript injection. Because the CVSS vector marks the exploit as unauthenticated (PR:N) with a scope change (S:C), the injected script crosses the plugin's security boundary into the browsing context of any user who triggers the payload, including higher-privileged administrators.

RemediationAI

No vendor-released patch version was identified at time of analysis in the provided data; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-debugging/vulnerability/wordpress-wp-debugging-plugin-2-12-2-cross-site-scripting-xss-vulnerability) and the plugin's WordPress.org page for a release newer than 2.12.2 and upgrade to it as the primary fix. As WP Debugging is a development/debugging tool, the strongest compensating control is to deactivate and remove the plugin from any production or internet-facing site, since it should not normally run in production - the trade-off is loss of on-site debug toggling, which is acceptable outside development. Where the plugin must remain, restrict access to the WordPress admin and the affected endpoints (for example via IP allowlisting or a WAF rule blocking script-injection patterns) and deploy a virtual-patching WAF such as Patchstack's until an official fixed version is confirmed, accepting that WAF rules can miss encoded payloads.