Two WordPress plugins that handle content arriving from outside the admin area received security notices from Wordfence on 30 October 2026, both updated on 31 October. One manages error logs, the other imports RSS and Atom feeds. In both cases the vendor fix was released before the public notice, so the practical question for a site owner is whether the update has been applied. This roundup reflects what we checked as of 1 November 2026. None of the reviewed notices reports exploitation in the wild. That is the absence of a report, not proof that abuse has never occurred.
Debug Log Manager: stored XSS through the JavaScript error logging endpoint
Who it affects. Sites running the Debug Log Manager plugin (slug debug-log-manager) at version 2.5.2 or earlier. The fix is 2.5.3 or any newer patched release. The issue is tracked as CVE-2026-120114 and was reported by Josef Azizov (Spoofable).
What the notice describes. Wordfence reports an unauthenticated stored cross-site scripting issue in the log_js_errors AJAX endpoint through its message and pageUrl values. No website account is needed. The conditions are that an administrator has turned on both debug logging and JavaScript error logging, and that the attacker can read the dlmVars.jsErrorLogging nonce, which the plugin prints on public pages while that feature is active, so it does not act as a secret. Under those conditions, anyone who can reach the endpoint can submit a crafted entry. The injected script runs in the browser of whoever views the affected log display, often an administrator. The notice does not describe code execution on the server.
What to check. Confirm the exact plugin slug and the active version. Check whether JavaScript error logging is enabled. If you suspect hostile entries, keep the log as evidence but avoid opening it in a vulnerable version of the viewer.
Fix and limits. Update to 2.5.3 or newer from the official plugin directory. The vendor changelog entry for 2.5.3, dated 19 October 2026, describes two changes with credit to Wordfence: encoded HTML markup in submitted JavaScript error entries is now decoded and stripped, and the log details returned to the viewer are escaped. The fix does not discard the error entries themselves. Patchstack published its own entry on 31 October and agrees on the affected range and fix version. After updating, verify the active version and trigger a harmless error to confirm logging still works. If debug and JavaScript logging are no longer needed once troubleshooting is done, turning them off reduces exposure, but that is not a replacement for the update. Deleting all logs is not advised; they may hold evidence.
Sources: Wordfence advisory, plugin page and changelog, Patchstack entry.
FeedWordPress: stored XSS through syndicated feed content
Who it affects. Sites running FeedWordPress (slug feedwordpress) at version 2026.0517 or earlier. The fix is 2026.1016 or newer. The issue is tracked as CVE-2026-110530 and was reported by Adrien Brunner.
What the notice describes. Content pulled from a subscribed RSS or Atom feed was stored without adequate sanitisation. No account on the WordPress site is required. The attacker needs control of an external feed the site has already subscribed to, which is how the malicious markup gets imported. Once stored, it can run in the browser of anyone, including an ordinary visitor, who views an affected post or page.
Fix. Version 2026.1016 applies WordPress KSES filtering to syndicated posts and excerpts. The vendor changelog names the CVE and credits Wordfence and the researcher.
Important limits. Filtering applies only to content syndicated or updated after the upgrade. Posts already imported remain as they are unless they are erased and resyndicated, or the source feed itself changes. We do not recommend erasing and resyndicating everything, because that can lose content and evidence. A qualified provider should review existing imports safely, with a backup in place, and plan a controlled cleanup only if something suspicious is found. The new release also requires WordPress 6.2 or later, so check your core version before updating. Because KSES removes some markup, embeds and formatting from feeds may look different afterwards. Run a sample import and review the layout, and use the moment to review which feeds you still trust.
Sources: Wordfence advisory, plugin page and changelog.
General advice for both
- Take a full backup and record current plugin and core versions before updating. Our backup strategy guide covers restore testing.
- An update closes the hole; it does not prove the site is clean. Unexpected admin accounts, changed files, or odd content in posts or logs warrant separate investigation.
- Monitoring beyond uptime helps catch content changes that a simple ping would miss.
- For broader hardening, see how to secure your WordPress website and our website security best practices.
- If you prefer someone else to track plugin notices like these, our WordPress maintenance page describes how we approach that work.
Both notices were disclosed on 30 October 2026 and the fixes predate them. The information above was checked on 1 November 2026, not discovered on that date.