WP-Safety
CVE-2026-57350

WP Debugging <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting

highImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
7.2
CVSS Score
7.2
CVSS Score
high
Severity
2.12.3
Patched in
7d
Time to patch

Description

The WP Debugging plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Low
Confidentiality
Low
Integrity
None
Availability

Technical Details

Affected versions<=2.12.2
PublishedJuly 1, 2026
Last updatedJuly 7, 2026
Affected pluginwp-debugging

What Changed in the Fix

Changes introduced in v2.12.3

Loading patch diff...

Source Code

WordPress.org SVN
Vulnerable v2.12.2
Browse source Download .zip
Patched v2.12.3
Browse source Download .zip
Research Plan
Unverified

The **WP Debugging** plugin for WordPress is vulnerable to **Unauthenticated Stored Cross-Site Scripting (XSS)** in versions up to 2.12.2. The vulnerability stems from the plugin's reliance on the `Debug Quick Look` library, which renders the contents of the WordPress `debug.log` file in the admin d…

Show full research plan

The WP Debugging plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) in versions up to 2.12.2. The vulnerability stems from the plugin's reliance on the Debug Quick Look library, which renders the contents of the WordPress debug.log file in the admin dashboard and admin bar without sufficient output escaping. An unauthenticated attacker can inject arbitrary JavaScript into the debug.log file by triggering PHP errors or notices containing malicious payloads.

1. Vulnerability Summary

  • Vulnerability: Unauthenticated Stored XSS
  • Location: vendor/norcross/debug-quick-look/debug-quick-look.php (rendered via WP Debugging)
  • Cause: The plugin enables WP_DEBUG_LOG and provides a feature to view these logs via Debug Quick Look. This viewer fails to escape the log entries before outputting them to the WordPress admin interface.
  • Impact: An unauthenticated attacker can inject scripts into the log file. When an administrator views any page where the debug log is displayed (e.g., the dashboard or via the admin bar menu), the script executes in the admin's session, potentially leading to full site takeover.

2. Attack Vector Analysis

  • Endpoint: Any public-facing URL or a specific endpoint that triggers a logged PHP error.
  • Payload Carrier: HTTP Request parameters (GET/POST), User-Agent, or any header that is typically reflected in
Research Findings
Static analysis — not yet PoC-verified

Summary

The WP Debugging plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) via the 'Debug Quick Look' library used to display log files. By triggering a PHP error that includes a malicious payload, an attacker can inject arbitrary JavaScript into the debug.log file, which is then executed when an administrator views the logs in the WordPress dashboard or admin bar.

Vulnerable Code

// composer.json (vulnerable version includes dependency version 0.1.12)
// Line 28
"name": "norcross/debug-quick-look",
"version": "0.1.12",

---

// readme.txt (describes the vulnerable logging feature)
// Line 11
Default settings:

    define( 'WP_DEBUG_LOG', true );
    define( 'SCRIPT_DEBUG', true );
    define( 'SAVEQUERIES', true );

...

[Debug Quick Look](https://github.com/norcross/debug-quick-look) from Andrew Norcross is included with this plugin to assist in reading the debug.log file.

Security Fix

diff -ru /home/deploy/wp-safety.org/data/plugin-versions/wp-debugging/2.12.2/CHANGES.md /home/deploy/wp-safety.org/data/plugin-versions/wp-debugging/2.12.3/CHANGES.md
--- /home/deploy/wp-safety.org/data/plugin-versions/wp-debugging/2.12.2/CHANGES.md	2024-12-02 19:42:02.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/wp-debugging/2.12.3/CHANGES.md	2026-06-12 18:27:58.000000000 +0000
@@ -1,5 +1,10 @@
 #### [unreleased]
 
+#### 2.12.3 /2026-06-11
+* composer update
+* update afragen/debug-quick-look escape raw output
+* update tested to
+
 #### 2.12.2 / 2024-12-02
 * add GA to generate POT
 * update for PCP
diff -ru /home/deploy/wp-safety.org/data/plugin-versions/wp-debugging/2.12.2/composer.json /home/deploy/wp-safety.org/data/plugin-versions/wp-debugging/2.12.3/composer.json
--- /home/deploy/wp-safety.org/data/plugin-versions/wp-debugging/2.12.2/composer.json	2024-12-02 19:42:02.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/wp-debugging/2.12.3/composer.json	2026-06-12 18:27:58.000000000 +0000
@@ -25,7 +25,7 @@
       "type": "package",
       "package": {
         "name": "norcross/debug-quick-look",
-        "version": "0.1.12",
+        "version": "0.1.14",
         "dist": {
           "url": "https://github.com/afragen/debug-quick-look/archive/vendor.zip",

Exploit Outline

To exploit this vulnerability, an unauthenticated attacker triggers a PHP error or notice on the target site while including a malicious JavaScript payload in a request parameter or header (e.g., a GET request to a known file with a non-existent parameter containing <script>alert(1)</script>). Because the plugin enables WP_DEBUG_LOG, the error and the payload are written to the WordPress debug log file. When an administrator later logs into the site and views the dashboard or accesses the 'Quick Look' menu in the admin bar, the library renders the log contents without proper escaping, causing the injected script to execute in the administrator's context.

References
https://www.wordfence.com/threat-intel/vulnerabilities/id/8727f4fa-b6a9-4da7-b2a5-5d74ddcc082f?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database