Unauthenticated XSS in WP Debugging Plugin

Executive Summary

CVE-2026-57350 is a Cross Site Scripting (XSS) vulnerability found in the WordPress WP Debugging Plugin versions 2.12.2 and earlier.

This vulnerability allows attackers to inject malicious scripts into the website, which can execute when visitors access the site.

Exploitation requires a privileged user to perform an action such as clicking a malicious link or submitting a form.

The vulnerability is considered medium priority with a CVSS score of 7.1, indicating moderate danger and potential for widespread exploitation.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can allow attackers to execute malicious scripts on your website.

• Attackers can inject redirects to malicious sites.
• Attackers can display unwanted advertisements.
• It can lead to compromised user trust and potential data exposure.

Because exploitation requires a privileged user to interact with malicious content, the risk involves social engineering or tricking authorized users.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability affects WordPress WP Debugging Plugin versions 2.12.2 and earlier.

To mitigate this vulnerability, immediately update the WP Debugging Plugin to version 2.12.3 or later.

Alternatively, users can enable auto-updates for vulnerable plugins if using Patchstack.

If you need assistance, contact your hosting provider or developers to apply the patch.

Useful 0 Not Useful 0