CVE-2026-117571
WP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker Device Parameters
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a logged-in administrator views the statistics pages.
| Vendor | unknown |
| Product | wp visitor statistics (real time traffic) |
| Published | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wp visitor statistics (real time traffic)
Be the first to know when new unknown vulnerabilities affecting unknown wp visitor statistics (real time traffic) are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / WP Visitor Statistics (Real Time Traffic)
0 < 8.8
References
Credits
an7ln WPScan