CVE-2026-9016: WordPress Debug Log Manager XSS Vulnerability

CVE-2026-9016 Overview

The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress contains an Improper Output Neutralization for Logs vulnerability [CWE-117] affecting all versions up to and including 2.5.0. The log_js_errors() AJAX handler is registered for unauthenticated users via wp_ajax_nopriv_log_js_errors and protected only by a nonce that is publicly disclosed in every front-end page's HTML through wp_localize_script(). Unauthenticated attackers can inject forged entries into the WordPress debug log by supplying attacker-controlled values for the message, script, lineNo, columnNo, and pageUrl fields. The vulnerability is exploitable only when the plugin's JavaScript error logging feature is enabled.

Critical Impact
Unauthenticated attackers can forge arbitrary entries in the WordPress debug log, obscuring malicious activity and misleading administrators during incident triage.

Affected Products

WordPress Debug Log Manager – Conveniently Monitor and Inspect Errors plugin
All versions up to and including 2.5.0
WordPress sites with the JavaScript error logging feature enabled

Discovery Timeline

2026-06-06 - CVE-2026-9016 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-9016

Vulnerability Analysis

The vulnerability resides in the plugin's client-side JavaScript error logging feature. The plugin registers an AJAX endpoint, log_js_errors(), hooked to wp_ajax_nopriv_log_js_errors so unauthenticated visitors can submit error reports. The handler validates requests using a WordPress nonce, but that nonce is emitted to every front-end page through wp_localize_script() whenever JavaScript error logging is active.

Any visitor can read the nonce from the HTML source and replay it in crafted AJAX requests. The handler then writes attacker-supplied values for message, script, lineNo, columnNo, and pageUrl directly into the WordPress debug log without sufficient neutralization. This allows attackers to fabricate fake stack traces, spoof error events, and pollute the log with high-volume noise.

Root Cause

The root cause is the conflation of a publicly disclosed nonce with an authorization control. Nonces in WordPress are intended to prevent CSRF, not to authenticate requests. By exposing the nonce in page HTML and relying on it as the sole gate for an _nopriv_ AJAX action, the plugin provides no meaningful authorization barrier. Compounding this, the log-writing routine does not neutralize line breaks or control characters in user-supplied fields, satisfying the conditions for [CWE-117] Improper Output Neutralization for Logs.

Attack Vector

Exploitation is remote and unauthenticated. An attacker requests any front-end page of a vulnerable site, parses the localized nonce from the HTML, then issues POST requests to admin-ajax.php with action=log_js_errors and crafted field values. Each request appends an attacker-controlled entry to the WordPress debug log. The vulnerability does not require user interaction and is exploitable only while the JavaScript error logging option is enabled.

See the Wordfence Vulnerability Analysis and the WordPress Debug Log Manager source for the relevant handler code.

Detection Methods for CVE-2026-9016

Indicators of Compromise

High volume of POST requests to /wp-admin/admin-ajax.php containing action=log_js_errors from unauthenticated clients.
WordPress debug.log entries containing injected newlines, unexpected stack traces, or values inconsistent with the site's actual JavaScript usage.
Repeated identical or templated error messages originating from a narrow set of IP addresses or user agents.

Detection Strategies

Monitor web access logs for unauthenticated requests to admin-ajax.php with the log_js_errors action and flag abnormal request rates.
Compare debug.log entries against expected browser-generated error patterns and alert on malformed or duplicated entries.
Integrate WordPress debug log content into a centralized log pipeline so injected entries can be correlated with surrounding web traffic.

Monitoring Recommendations

Forward WordPress debug.log and web server access logs to a centralized SIEM for correlation and retention.
Establish baselines for JavaScript error volume per site and alert on sudden spikes that may indicate log poisoning.
Treat the WordPress debug log as untrusted input during incident triage when this plugin is deployed.

How to Mitigate CVE-2026-9016

Immediate Actions Required

Disable the JavaScript error logging feature in the Debug Log Manager plugin until a patched version is installed, since the issue is only exploitable when this feature is enabled.
Update the Debug Log Manager plugin to a version newer than 2.5.0 once the vendor publishes a fix.
Audit existing WordPress debug logs for forged entries before relying on them for incident investigation.

Patch Information

At the time of publication, the vulnerability affects all versions up to and including 2.5.0. Refer to the WordPress Debug Log Manager Changeset and the Wordfence Vulnerability Analysis for current fix status.

Workarounds

Turn off the plugin's JavaScript error logging option so the nonce is no longer emitted in front-end HTML.
Restrict access to wp-admin/admin-ajax.php for the log_js_errors action at the web application firewall (WAF) layer.
Disable WP_DEBUG_LOG in production or redirect debug output to a location not consumed by automated alerting until the plugin is patched.

bash

# Example: disable WP_DEBUG_LOG in wp-config.php
define( 'WP_DEBUG', false );
define( 'WP_DEBUG_LOG', false );
define( 'WP_DEBUG_DISPLAY', false );