CVE-2026-120114

Name of the Vulnerable Software and Affected Versions Debug Log Manager – Conveniently Monitor and Inspect Errors versions prior to 2.5.3

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. This occurs via the message and pageUrl parameters. Attackers can inject arbitrary web scripts that execute when a user accesses an affected page. Exploitation requires the site administrator to have debug logging enabled with JS error logging active, and the attacker must obtain the dlmVars.jsErrorLogging nonce, which is broadcast on every frontend page, to bypass the nonce check on the unauthenticated endpoint.

Recommendations Update the plugin to a version newer than 2.5.2. As a temporary mitigation, disable JS error logging within the debug logging settings.