CVE-2026-117571: WP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker Device Parameters

Q: Who is exposed to this issue?

Sites using a version of the WP Visitor Statistics (Real Time Traffic) plugin earlier than 8.8 are affected. An attacker can submit crafted public visitor requests without authenticating, but script execution occurs when a logged-in administrator views the plugin's statistics dashboard.

Q: Does exploitation require any special access or configuration?

No attacker account or privileges are required. The vulnerable tracking data is derived from public visitor requests, so any site that records such requests and has an administrator review the statistics pages may be exposed.

Q: How can I determine whether the site may already be affected?

Review the installed plugin version and treat versions earlier than 8.8 as vulnerable. Also inspect the administrative statistics dashboard and stored tracking data for unexpected or suspicious visitor-derived values.

Published Oct 30, 2026

Updated

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a logged-in administrator views the statistics pages.

Event History

Oct 30, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Data Sourced

via NVD·06:16 AM

SeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Sites using a version of the WP Visitor Statistics (Real Time Traffic) plugin earlier than 8.8 are affected. An attacker can submit crafted public visitor requests without authenticating, but script execution occurs when a logged-in administrator views the plugin's statistics dashboard.

Does exploitation require any special access or configuration?

No attacker account or privileges are required. The vulnerable tracking data is derived from public visitor requests, so any site that records such requests and has an administrator review the statistics pages may be exposed.

How can I determine whether the site may already be affected?

Review the installed plugin version and treat versions earlier than 8.8 as vulnerable. Also inspect the administrative statistics dashboard and stored tracking data for unexpected or suspicious visitor-derived values.

CVE-2026-117571: WP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker Device Parameters

Event History

Frequently Asked Questions

Who is exposed to this issue?

Does exploitation require any special access or configuration?

How can I determine whether the site may already be affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

Does exploitation require any special access or configuration?

How can I determine whether the site may already be affected?