CVE-2026-93367: Visitors Traffic Real Time Statistics Pro <= 11.22 - Unauthenticated Stored Cross-Site Scripting via ahcpro_track_visitor (page_title)
The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting in all versions up to, and including, 11.22 via the pagetitle parameter of the ahcprotrackvisitor AJAX action. The action is registered for logged-out callers (wpajaxnoprivahcprotrackvisitor) and stores $POST['pagetitle'] with NO sanitization, keeping it raw in the ahctitletraffic.tilpagetitle column. When an administrator opens the plugin's dashboard, the 'Traffic by Title' DataTable renders that stored value as innerHTML without output escaping, executing arbitrary JavaScript. This makes it possible for unauthenticated attackers to inject web scripts that run in an administrator's session.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and what access is required?
Any unauthenticated remote attacker can submit a crafted page_title value to the ahcpro_track_visitor AJAX action. No WordPress account, privileges, or user interaction from the attacker is required.
What conditions are needed for the injected script to execute?
The attacker-controlled value is stored in the plugin's traffic database table and executes when an administrator opens the plugin dashboard and views the Traffic by Title DataTable. The impact therefore depends on an administrator accessing that dashboard after malicious data has been recorded.
Are default public-facing deployments exposed?
The vulnerable AJAX action is explicitly registered for logged-out callers, so sites using an affected version can be exposed to unauthenticated submissions through that action. The issue affects versions through 11.22.
How can I check whether the site may already contain injected content?
Review records in the ahc_title_traffic table, particularly the til_page_title column, for unexpected or script-like page-title values. Treat opening the affected Traffic by Title dashboard view cautiously because stored values are rendered as innerHTML without output escaping.