CVE-2026-90986: WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.21 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.21 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Visitor Traffic Real Time Statistics Pro pluginto a version that resolves this vulnerability.Fixed in 11.22
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or plugin-level privileges. Exploitation still requires user interaction, as indicated by the UI:R attack vector.
Which installations are affected?
Visitor Traffic Real Time Statistics Pro versions 11.21 and earlier are identified as affected. The provided data does not state whether any particular WordPress configuration or plugin setting is required.
What impact could successful exploitation have?
The vulnerability is cross-site scripting with low confidentiality, integrity, and availability impact in the supplied vector. Its scope is changed, indicating the impact can extend beyond the vulnerable component's security authority.