Threats tagged 'ghsa-36wm-h889-8m5h'

The Debug Log Manager plugin for WordPress up to version 2.5.2 is vulnerable to stored cross-site scripting (XSS) via the 'message' and 'pageUrl' parameters. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires that debug logging with JavaScript error logging is enabled and that the attacker can obtain a publicly emitted nonce to bypass endpoint checks.