Log HTTP Requests
Log HTTP Requests has one disclosed vulnerability in the WordSec catalog, all reported in 2022; it is fixed as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Log HTTP Requests has a vendor fix available, so running the current release closes it.
All of these findings were reported by Etan Imanol Castro Aldrete. Log HTTP Requests is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.
CVE-2022-3402Log HTTP Requests <= 1.3.1 - Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Log HTTP Requests
Author
Matt Gibbs
Log and view all WP HTTP requests How long do [core / plugin / theme] update checks take to run? What data about my site is being sent out? What about all those ajax requests? The answers to these questions are just a few clicks away. This plugin logs all WP_HTTP requests and displays them in a table listing for easy viewing. It also stores the runtime of each HTTP request. Available Hooks Customize the length (in days) before older log items are removed: add_filter( 'lhr_expiration_days', function( $days ) { return 7; // default = 1 }); Don’t log items from a specific hostname: add_filter( 'lhr_log_data', function( $data ) { if ( false !== strpos( $data['url'], 'wordpress.org' ) ) { return false; } return $data; }); In the above example, the $data array keys correspond to columns within the lhr_log database table. Important Links Github →
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C