WordPress Core version 5.6.2 appears to suffer from an xpath injection vulnerability via the log parameter.