Developer Loggers for Simple History WordPress Plugin

Developer Loggers for Simple History

Developer Loggers for Simple History is a WordPress plugin with the following stats:

#11,632 Global Rank

400+ active installs

Since 2015 11 years active

Vulnerabilities

1 Total

1 Patched

0 Active

100% Resolved rate

Developer Loggers for Simple History <= 0.5 - Authenticated (Admin+) Local File Inclusion

CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The Developer Loggers for Simple History plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.5 via the enabled_loggers parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

6.6 Medium Affected All – 0.5 Patched in ✓ 0.5.1 Published 16 Sep 2025 CVE CVE-2025-10050

About Developer Loggers for Simple History

Useful loggers for SimpleHistory for developers during development of a site or to maintain a live site.

Bring more loggers to WordPress user history plugin Simple History.
That are useful for developers during development of a site or to maintain a live site.

Important

Please note that this plugin is no longer actively maintained and only receives security fixes.

Modern and up to date alternatives

For an up to date alternative please see the Debug & Monitor add-on which logs WP REST API requests, sent emails, HTTP API requests, and WP cron jobs.

Get more features with Simple History Premium

Need advanced WordPress audit logging capabilities? Simple History Premium extends your site monitoring with powerful features:

Enhanced WordPress Activity Logging:

Advanced Analytics Dashboard – Comprehensive stats and visual activity tracking
Custom Event Logging – Add manual entries and notifications to your audit trail
Stealth Mode – Control user access with granular permissions
Flexible Log Retention – Configure automatic cleanup or keep logs indefinitely
Data Export Tools – Export logs in CSV/JSON format for analysis
Security Features – IP anonymization and login attempt location tracking

» Get Simple History Premium

Included loggers and plugins

Post to Slack

All your events is posted to a Slack channel of your choice, using an incoming webhook. Yes, with this plugin enabled
there is no need what so ever to ever leave Slack to see what’s happening on your site or the site of your
clients or… well, on any site where you have Simple Histor and this plugin enabled.

WP_Mail-logger

See all mails sent with wp_mail(), no matter what the recipient address is.
changelog

404 logger

View page visits that load the 404 template.

JavaScript error logger

See what JavaScript errors users that visit your site is getting.

SystemLog logger

Log all messages from Simple History to the syslog on the server. With this logger enabled there is no need to use the beautiful GUI of Simple History ;).

HTTP API logger

Log all usage of HTTP calls from functions like wp_remote_post() and wp_remote_get().

You can the URL requested, the arguments posted and the full returned result, including server headers.

The time for the request to complete is also logged. Great for debugging!

Screenshots

Enable the loggers you want in Settings » Simple History » Developer loggers.

Example output of the WordPress Cron debug logger.

Example output of the WPMail logger. You can see the subject, who the mail is sent to, and the contents of the body.

Example output form the HTTP API logger. View method and target URL.

Details from the HTTP API logger. Even more details here, like all the headers in the response and also the full response.

Example output from the WordPress post to Slack Logger. Here you can see me failing to login, then succeeding to login, updating a plugin, and finally I log out.

Changelog

0.5.1 (September 2025)

Security fix: Fixed Local File Inclusion vulnerability (CVE-2025-10050) by adding proper sanitization to logger slug parameters. Thanks to Jonas Benjamin Friedli for responsible disclosure via Wordfence.

0.5 (November 2016)

Add notice in admin that Simple History must be installed and activated to use this plugin.
Add some very basic Travis CI tests, so the plugin is less likely to cause any obvious errors.
The Available Updates Logger has now moved to the main Simple History plugin, because it’s useful for most users and not only admins.
Added filter simple_history/developer_loggers/enabled_loggers to modify what plugins are enabled.
Added filter simple_history/developer_loggers/slackit/settings to modify the settings of the Slackit logger.
Added examples.php with some examples of filter usage.

0.4.1 (August 2016)

Check that the sys_getloadavg() exists before trying to use. Could cause error on Windows.

0.4 (August 2016)

Logger for Limit Logins Attempts has moved to Simple History, so more users can benefit from it.
When a plugin update is found: use the english name for the plugin, instead of the translated name.

0.3.4 (June 2016)

Bump up requirement to 5.4 because I’m to tired to write code for 5.3

0.3.3 (June 2016)

Fixed notice warning in post to Slack
Add error message if not running PHP 5.3 or higher
Change unit in HTTP API message from milliseconds to seconds

0.3.2 (May 2016)

Added: Logger HTTP API Logger that logs all GET and POST requests made using for example wp_remote_get() and wp_remote_post().
Fixed: The logger for available updates could throw a fatal error on the plugin install screen. Hopefully fixed now, and if
then it fixes https://github.com/bonny/Developer-Loggers-for-Simple-History/issues/1 (the very first issue for this plugin! 🎉).

0.3.1 (March 2016)

Fixed: Function __return_empty_string is not called _return_empty_string…
Fixed: Undefined notice for $initiator_text in the post to Slack plugin

0.3 (February 2016)

Added: New plugin: Slack! Yes, now all your logged events can be posted to a Slack channel of your choice.
Added: Actions simple_history/developer_loggers/before_plugins_table and simple_history/developer_loggers/before_plugins_table.