Debug Log Manager EUVD-2026-114705

Two concrete prerequisites must both hold: (1) the site administrator must have debug logging enabled with JS error logging active - a non-default feature state - otherwise the vulnerable unauthenticated endpoint is not active; and (2) the attacker must obtain the dlmVars.jsErrorLogging nonce, which the plugin broadcasts in the source of every frontend page, and replay it to pass the endpoint's nonce check. Injection occurs through the 'message' and 'pageUrl' parameters, and the stored payload fires when any user (potentially an administrator) later views the injected log page. The limiting factor is the non-default JS-error-logging configuration; the public nonce means the nonce check itself imposes no practical barrier, so where the feature is enabled, exploitation is effectively unauthenticated and remote.

This is a genuine but conditional priority rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 High) describes a network-reachable, low-complexity, unauthenticated stored XSS with a changed scope, which on its face looks broadly exploitable. However, the description materially constrains that picture: exploitation only works if the site administrator has debug logging enabled AND JS error logging active, which is a non-default operational state, and the attacker must first scrape the dlmVars.jsErrorLogging nonce that the plugin broadcasts on every frontend page. The PR:N rating is defensible precisely because that nonce is public, so the nonce check provides no real authentication barrier. The vuln.today Decision label is 'this_week', consistent with a serious-but-not-critical item. No EPSS probability was supplied, there is no CISA KEV listing, and no verified exploit code is indicated - the references are the Wordfence advisory and plugin source/changeset links, not a working PoC. Net: a real High-severity issue worth patching this week, but its real-world blast radius is gated by a non-default configuration, so it is less universally exploitable than the raw 7.2 suggests. The strongest and most reliable signal is the CVSS vector and CWE-79 from Wordfence; the main missing signals are EPSS and any exploitation telemetry.

An unauthenticated attacker visits a target WordPress site running Debug Log Manager ≤2.5.2 where JS error logging is enabled, reads the dlmVars.jsErrorLogging nonce emitted in the public frontend page source, and replays it to the plugin's unauthenticated error-logging endpoint with a malicious script embedded in the 'message' or 'pageUrl' value. The payload is stored in the debug log and later executes in the browser of anyone (including an administrator) who views the injected log entry. No public exploit code is identified at time of analysis, though the trigger path is clearly documented in the vendor advisory.