CVE-2025-3809: 
WordPress vulnerability analysis and mitigation

The Debug Log Manager plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2025-3809) discovered in versions up to and including 2.3.4. The vulnerability was disclosed on April 19, 2025, and affects the auto-refresh debug log functionality (NVD).

The vulnerability stems from insufficient input sanitization and output escaping in the auto-refresh debug log feature. This security flaw has been assigned a CVSS v3.1 Base Score of 7.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD, Wordfence).

The vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses an injected page. This can lead to potential compromise of user sessions, theft of sensitive information, and other malicious actions performed in the context of the affected user's browser (NVD).

The vulnerability is exploitable by unauthenticated attackers and requires no user interaction for successful exploitation. The attack complexity is rated as low, indicating relatively straightforward exploitation (NVD).

A patch has been released in version 2.3.5 of the Debug Log Manager plugin. Users are strongly advised to update to this version to mitigate the vulnerability (WordPress Plugin Repository).