Executive brief
WP Debugging, a WordPress plugin used by developers to troubleshoot site issues, is vulnerable to a security flaw that allows attackers to inject malicious scripts. If a site administrator or user clicks a specially crafted link, an attacker could execute code in their browser, potentially leading to unauthorized actions or the theft of sensitive session information. This vulnerability can be resolved by updating the plugin to version 2.12.3 or later.
Technical details
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the WP Debugging plugin for WordPress due to improper neutralization of user-supplied input (CWE-79). The flaw affects all versions up to and including 2.12.2. An unauthenticated remote attacker can exploit this by tricking a user into interacting with a malicious link or crafted page. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session, which can lead to session hijacking or unauthorized administrative actions. The issue is addressed in version 2.12.3.
Affected products
- Andy Fragen WP Debugging <= 2.12.2
Timeline
- 2026-06-08: disclosed: Reported by Ananda Dhakal via Patchstack
- 2026-07-01: advisory: Patchstack advisory published
- 2026-07-02: advisory: NVD published CVE-2026-57350
- 2026-07-02: patched: Version 2.12.3 released to address the vulnerability