# CVE-2026-120114: CVE-2026-120114

Status: published. Published: 2026-10-31. Updated: 2026-11-01.

The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message (and pageUrl)' parameter in all versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that the site administrator has debug logging enabled with JS error logging active, and that the attacker can obtain the publicly emitted dlmVars.jsErrorLogging nonce — which is broadcast on every frontend page — to pass the nonce check on the unauthenticated endpoint.

## Remediation

No remediation reported in collected sources

## Affected products and versions

Not reported in collected sources.

## Severity and prioritization

- CVSS 3.1: 7.2 (high); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N; source: NVD: security@wordfence.com

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: exploitation none; automatable no; technical impact partial; source NVD SSVC: 134c704f-9b21-4f2e-91b3-4a467353bcc0

- Weaknesses: CWE-79

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.5.2/bootstrap.php#L134 (security@wordfence.com)

- https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.5.2/bootstrap.php#L567 (security@wordfence.com)

- https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.5.2/classes/class-debug-log.php#L1605 (security@wordfence.com)

- https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.5.2/classes/class-debug-log.php#L1728 (security@wordfence.com)

- https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.5.2/classes/class-debug-log.php#L2158 (security@wordfence.com)

- https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.5.2/classes/class-debug-log.php#L519 (security@wordfence.com)

- https://plugins.trac.wordpress.org/changeset?reponame=&old=3754121%40debug-log-manager&new=3754121%40debug-log-manager (security@wordfence.com)

- https://www.wordfence.com/threat-intel/vulnerabilities/id/904181bc-fd56-4296-9c59-532bbc272abd?source=cve (security@wordfence.com)

## Provenance

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-120114; retrieved 2026-11-02; source updated 2026-11-01

Revision: 370cac99a752a398eb7ca20c25cb5bad16f6e20675dbc572de8fda06edf3fa93

Canonical: https://y2.dev/cve/CVE-2026-120114