Debug Log Manager Conveniently Monitor And Inspect Errors
Monthly
Stored cross-site scripting in the WordPress plugin Debug Log Manager (all versions through 2.5.2) lets unauthenticated remote attackers inject script through the 'message' and 'pageUrl' fields, which executes when a user views the injected log page. Exploitation is conditional: the site must have debug logging enabled with JS error logging active, and the attacker must use the publicly broadcast dlmVars.jsErrorLogging nonce to pass the unauthenticated endpoint's nonce check. This is a genuine but conditional this_week priority rather than a drop-everything emergency; no public exploit identified at time of analysis and active exploitation is not confirmed by the supplied data.
Log injection in the Debug Log Manager WordPress plugin (versions up to and including 2.5.0) allows unauthenticated remote attackers to write arbitrary forged entries into the site's debug log. The root cause is a broken authorization design: the `log_js_errors()` AJAX handler is registered for unauthenticated users via `wp_ajax_nopriv_log_js_errors`, and the only gate-a WordPress nonce-is publicly broadcast in every page's front-end HTML via `wp_localize_script()` whenever JavaScript error logging is enabled, rendering it non-secret and thus non-protective. Exploitation enables log spoofing, masking of real malicious activity behind fabricated noise, and manipulation of administrator triage decisions. No public exploit identified at time of analysis and this CVE is not listed in CISA KEV.
Stored cross-site scripting in the WordPress plugin Debug Log Manager (all versions through 2.5.2) lets unauthenticated remote attackers inject script through the 'message' and 'pageUrl' fields, which executes when a user views the injected log page. Exploitation is conditional: the site must have debug logging enabled with JS error logging active, and the attacker must use the publicly broadcast dlmVars.jsErrorLogging nonce to pass the unauthenticated endpoint's nonce check. This is a genuine but conditional this_week priority rather than a drop-everything emergency; no public exploit identified at time of analysis and active exploitation is not confirmed by the supplied data.
Log injection in the Debug Log Manager WordPress plugin (versions up to and including 2.5.0) allows unauthenticated remote attackers to write arbitrary forged entries into the site's debug log. The root cause is a broken authorization design: the `log_js_errors()` AJAX handler is registered for unauthenticated users via `wp_ajax_nopriv_log_js_errors`, and the only gate-a WordPress nonce-is publicly broadcast in every page's front-end HTML via `wp_localize_script()` whenever JavaScript error logging is enabled, rendering it non-secret and thus non-protective. Exploitation enables log spoofing, masking of real malicious activity behind fabricated noise, and manipulation of administrator triage decisions. No public exploit identified at time of analysis and this CVE is not listed in CISA KEV.