CVE-2019-25315

WP Server Log Viewer 1.0 - 'logfile' Persistent Cross-Site Scripting

State: Published
Severity: 5.1 Medium
Published: Feb 11, 2026
Updated: Feb 11, 2026
Reserved: Feb 11, 2026

Description

WordPress Server Log Viewer 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unfiltered log file paths. Attackers can add log files with embedded XSS payloads that will execute when viewed in the WordPress admin interface.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N	VulnCheck
3.1	6.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	VulnCheck

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
WP Server Log Vieweranttiviljami	1.0Affected

References

ExploitDB-47419exploit
WP Server Log Viewer GitHub Repositoryproduct
VulnCheck Advisory: WP Server Log Viewer 1.0 - 'logfile' Persistent Cross-Site Scriptingthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.