Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 237,438 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · debug-log-manager
Debug Log Manager
9 known vulnerabilities on record. Add your version above to see which ones affect you.
Jun 6, 2026Debug Log Manager – Conveniently Monitor and Inspect Errors: Improper Output Neutralization for LogsCVE-2026-9016 · affects up to 2.5.0 · reported by WordfenceMedium 5.3
The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Improper Output Neutralization for Logs in all versions up to, and including, 2.5.0. This is due to the `log_js_errors()` AJAX handler being registered for unauthenticated users via `wp_ajax_nopriv_log_js_errors` and gated only by a nonce that is publicly disclosed in every front-end page's HTML through `wp_localize_script()` whenever JavaScript error logging is enabled, providing no real authorization barrier. This makes it possible for unauthenticated attackers to inject arbitrary forged entries into the site's WordPress debug log by supplying attacker-controlled values for the `message`, `script`, `lineNo`, `columnNo`, and `pageUrl` fields — enabling spoofing of error and incident records, obscuring malicious activity within fabricated log noise, and misleading administrators who rely on the log for triage. This vulnerability is only exploitable when the plugin's JavaScript error logging feature is enabled, as the requisite nonce is only published into the page HTML under that condition.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 19, 2025Debug Log Manager: Stored Cross-Site ScriptingCVE-2025-3809 · affects up to 2.3.4 · reported by WordfenceHigh 7.2
The Debug Log Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the auto-refresh debug log in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2025-32613 is a duplicate of this CVE.
Apr 17, 2025Debug Log Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32613 · affects up to 2.3.4 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bowo Debug Log Manager debug-log-manager allows Stored XSS.This issue affects Debug Log Manager: from n/a through <= 2.3.4.
Jun 9, 2024Debug Log Manager: Missing AuthorizationCVE-2024-35669 · affects up to 2.3.1 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.1.
May 3, 2024Debug Log Manager: Missing AuthorizationCVE-2024-33915 · affects up to 2.3.1 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.1.
Apr 18, 2024Debug Log Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32582 · affects up to 2.3.1 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bowo Debug Log Manager allows Stored XSS.This issue affects Debug Log Manager: from n/a through 2.3.1.
Jan 8, 2024Debug Log Manager: Contains a Directory listing vulnerability was discoveredCVE-2023-6383 · fixed in 2.3.0 · reported by WPScanHigh 7.5
The Debug Log Manager WordPress plugin before 2.3.0 contains a Directory listing vulnerability was discovered, which allows you to download the debug log without authorization and gain access to sensitive data
Nov 30, 2023Debug Log Manager: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-6136 · affects up to 2.3.0 · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.0.
Nov 29, 2023Debug Log Manager: Cross-Site Request ForgeryCVE-2023-5772 · affects up to 2.2.1 · reported by WordfenceMedium 4.3
The Debug Log Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation on the clear_log() function. This makes it possible for unauthenticated attackers to clear the debug log via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.