Debug Log Manager Vulnerabilities

The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Improper Output Neutralization for Logs in all versions up to, and including, 2.5.0. This is due to the `log_js_errors()` AJAX handler being registered for unauthenticated users via `wp_ajax_nopriv_log_js_errors` and g...

CVSS:

5.3

Affected:

up to 2.5.0

Fixed in:

2.5.1

Disclosed:

Jun 5, 2026

CVE-2026-9016 on NVD →

The Debug Log Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the auto-refresh debug log in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages tha...

CVSS:

7.2

Affected:

up to 2.3.4

Fixed in:

2.3.5

Disclosed:

Apr 18, 2025

CVE-2025-3809 on NVD →

The Debug Log Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user acce...

CVSS:

7.2

Affected:

up to 2.3.4

Fixed in:

2.3.5

Disclosed:

Apr 17, 2025

CVE-2025-32613 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bowo Debug Log Manager allows Stored XSS. This issue affects Debug Log Manager: from n/a through 2.3.4.

Affected:

up to 2.3.5

Fixed in:

2.3.5

Disclosed:

Apr 17, 2025

CVE-2025-32613 on NVD →

[en] Missing Authorization vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.1.

Affected:

up to 2.3.2

Fixed in:

2.3.2

Disclosed:

Jun 9, 2024

CVE-2024-35669 on NVD →

The Debug Log Manager plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the get_latest_entries and disable_wp_file_editor functions in versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with subscriber-level acc...

CVSS:

5.4

Affected:

up to 2.3.1

Fixed in:

2.3.2

Disclosed:

Jun 3, 2024

CVE-2024-35669 on NVD →

[en] Missing Authorization vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.1.

Affected:

up to 2.3.2

Fixed in:

2.3.2

Disclosed:

May 3, 2024

CVE-2024-33915 on NVD →

The Debug Log Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the toggle_debugging function in versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to toggle debugging.

CVSS:

4.3

Affected:

up to 2.3.1

Fixed in:

2.3.2

Disclosed:

Apr 29, 2024

CVE-2024-33915 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bowo Debug Log Manager allows Stored XSS.This issue affects Debug Log Manager: from n/a through 2.3.1.

Affected:

up to 2.3.2

Fixed in:

2.3.2

Disclosed:

Apr 18, 2024

CVE-2024-32582 on NVD →

The Debug Log Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user...

CVSS:

7.2

Affected:

up to 2.3.1

Fixed in:

2.3.2

Disclosed:

Apr 16, 2024

CVE-2024-32582 on NVD →

[en] The Debug Log Manager WordPress plugin before 2.3.0 contains a Directory listing vulnerability was discovered, which allows you to download the debug log without authorization and gain access to sensitive data

Affected:

up to 2.3.0

Fixed in:

2.3.0

Disclosed:

Jan 8, 2024

CVE-2023-6383 on NVD →

The Debug Log Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.2 due to directory listing allowed in the folder housing debug logs. This makes it possible for unauthenticated attackers to extract data from debug logs.

CVSS:

5.3

Affected:

up to 2.2.2

Fixed in:

2.3.0

Disclosed:

Dec 13, 2023

CVE-2023-6383 on NVD →

[en] The Debug Log Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation on the clear_log() function. This makes it possible for unauthenticated attackers to clear the debug log via a forged request gran...

Affected:

up to 2.2.2

Fixed in:

2.2.2

Disclosed:

Nov 30, 2023

CVE-2023-5772 on NVD →

[en] Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.0.

Affected:

up to 2.2.2

Fixed in:

2.2.2

Disclosed:

Nov 30, 2023

CVE-2023-6136 on NVD →

The Debug Log Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation on the clear_log() function. This makes it possible for unauthenticated attackers to clear the debug log via a forged request granted t...

CVSS:

4.3

Affected:

up to 2.2.1

Fixed in:

2.2.2

Disclosed:

Nov 29, 2023

CVE-2023-5772 on NVD →

The Debug Log Manager plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the clear_log() function hooked via AJAX in all versions up to, and including, 2.2.1. This makes it possible for attackers, with subscriber-level access and above, to clear the debug logs.

CVSS:

4.3

Affected:

up to 2.2.1

Fixed in:

2.2.2

Disclosed:

Nov 23, 2023

CVE-2023-6136 on NVD →

Affected:

up to 2.3.5

Fixed in:

2.3.5

CVE-2025-3809 on NVD →