Debug Bar
Debug Bar has one disclosed vulnerability in the WordSec catalog, all reported in 2013; it is fixed as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Debug Bar has a vendor fix available, so running the current release closes it.
Debug Bar is installed on roughly 20,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2013-10021Debug Bar <= 0.8 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records
Debug Bar
Author
WordPress.org
Adds a debug menu to the admin bar that shows query, cache, and other helpful debugging information. A must for developers! When WP_DEBUG is enabled it also tracks PHP Warnings and Notices to make them easier to find. When SAVEQUERIES is enabled the mysql queries are tracked and displayed. To enable these options, add the following code to your wp-config.php file: define( 'WP_DEBUG', true ); define( 'SAVEQUERIES', true ); Add a PHP/MySQL console with the Debug Bar Console plugin. There are numerous other add-ons available to get more insight into, for instance, the registered Post Types, Shortcodes, WP Cron, Language file loading, Actions and Filters and so on. Just search the plugin directory for ‘Debug Bar’.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C