[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPaMDG-iZOAyAOUeEm1TLr6wk27tcYwZY12sMaUL8qsY":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-57350","wp-debugging-unauthenticated-stored-cross-site-scripting","WP Debugging \u003C= 2.12.2 - Unauthenticated Stored Cross-Site Scripting","The WP Debugging plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","wp-debugging",null,"\u003C=2.12.2","2.12.3","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-01 00:00:00","2026-07-07 19:46:30",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F8727f4fa-b6a9-4da7-b2a5-5d74ddcc082f?source=api-prod",7,[22,23,24,25,26,27,28,29],"CHANGES.md","composer.json","readme.txt","src\u002FSettings.php","vendor\u002Fafragen\u002Fwp-dependency-installer\u002Fcomposer.json","vendor\u002Fafragen\u002Fwp-dependency-installer\u002Fwp-dependency-installer.php","vendor\u002Fautoload.php","vendor\u002Fcomposer\u002FInstalledVersions.php","researched",false,3,"The **WP Debugging** plugin for WordPress is vulnerable to **Unauthenticated Stored Cross-Site Scripting (XSS)** in versions up to 2.12.2. The vulnerability stems from the plugin's reliance on the `Debug Quick Look` library, which renders the contents of the WordPress `debug.log` file in the admin dashboard and admin bar without sufficient output escaping. An unauthenticated attacker can inject arbitrary JavaScript into the `debug.log` file by triggering PHP errors or notices containing malicious payloads.\n\n### 1. Vulnerability Summary\n*   **Vulnerability:** Unauthenticated Stored XSS\n*   **Location:** `vendor\u002Fnorcross\u002Fdebug-quick-look\u002Fdebug-quick-look.php` (rendered via `WP Debugging`)\n*   **Cause:** The plugin enables `WP_DEBUG_LOG` and provides a feature to view these logs via `Debug Quick Look`. This viewer fails to escape the log entries before outputting them to the WordPress admin interface.\n*   **Impact:** An unauthenticated attacker can inject scripts into the log file. When an administrator views any page where the debug log is displayed (e.g., the dashboard or via the admin bar menu), the script executes in the admin's session, potentially leading to full site takeover.\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** Any public-facing URL or a specific endpoint that triggers a logged PHP error.\n*   **Payload Carrier:** HTTP Request parameters (GET\u002FPOST), User-Agent, or any header that is typically reflected in","The WP Debugging plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) via the 'Debug Quick Look' library used to display log files. By triggering a PHP error that includes a malicious payload, an attacker can inject arbitrary JavaScript into the debug.log file, which is then executed when an administrator views the logs in the WordPress dashboard or admin bar.","\u002F\u002F composer.json (vulnerable version includes dependency version 0.1.12)\n\u002F\u002F Line 28\n\"name\": \"norcross\u002Fdebug-quick-look\",\n\"version\": \"0.1.12\",\n\n---\n\n\u002F\u002F readme.txt (describes the vulnerable logging feature)\n\u002F\u002F Line 11\nDefault settings:\n\n    define( 'WP_DEBUG_LOG', true );\n    define( 'SCRIPT_DEBUG', true );\n    define( 'SAVEQUERIES', true );\n\n...\n\n[Debug Quick Look](https:\u002F\u002Fgithub.com\u002Fnorcross\u002Fdebug-quick-look) from Andrew Norcross is included with this plugin to assist in reading the debug.log file.","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwp-debugging\u002F2.12.2\u002FCHANGES.md \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwp-debugging\u002F2.12.3\u002FCHANGES.md\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwp-debugging\u002F2.12.2\u002FCHANGES.md\t2024-12-02 19:42:02.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwp-debugging\u002F2.12.3\u002FCHANGES.md\t2026-06-12 18:27:58.000000000 +0000\n@@ -1,5 +1,10 @@\n #### [unreleased]\n \n+#### 2.12.3 \u002F2026-06-11\n+* composer update\n+* update afragen\u002Fdebug-quick-look escape raw output\n+* update tested to\n+\n #### 2.12.2 \u002F 2024-12-02\n * add GA to generate POT\n * update for PCP\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwp-debugging\u002F2.12.2\u002Fcomposer.json \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwp-debugging\u002F2.12.3\u002Fcomposer.json\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwp-debugging\u002F2.12.2\u002Fcomposer.json\t2024-12-02 19:42:02.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwp-debugging\u002F2.12.3\u002Fcomposer.json\t2026-06-12 18:27:58.000000000 +0000\n@@ -25,7 +25,7 @@\n       \"type\": \"package\",\n       \"package\": {\n         \"name\": \"norcross\u002Fdebug-quick-look\",\n-        \"version\": \"0.1.12\",\n+        \"version\": \"0.1.14\",\n         \"dist\": {\n           \"url\": \"https:\u002F\u002Fgithub.com\u002Fafragen\u002Fdebug-quick-look\u002Farchive\u002Fvendor.zip\",","To exploit this vulnerability, an unauthenticated attacker triggers a PHP error or notice on the target site while including a malicious JavaScript payload in a request parameter or header (e.g., a GET request to a known file with a non-existent parameter containing \u003Cscript>alert(1)\u003C\u002Fscript>). Because the plugin enables WP_DEBUG_LOG, the error and the payload are written to the WordPress debug log file. When an administrator later logs into the site and views the dashboard or accesses the 'Quick Look' menu in the admin bar, the library renders the log contents without proper escaping, causing the injected script to execute in the administrator's context.","gemini-3-flash-preview","2026-07-25 11:45:27","2026-07-25 11:47:02",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","2.12.2","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-debugging\u002Ftags\u002F2.12.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwp-debugging.2.12.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-debugging\u002Ftags\u002F2.12.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwp-debugging.2.12.3.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-debugging\u002Ftags"]