CVE-2026-117571

HighCVSS 8.8

Published: 30/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboard. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a logged-in administrator views the statistics pages.

Risk Assessment

An unauthenticated attacker can execute a malicious script in an administrator's browser, risking administrative session hijacking and full site compromise.

Recommendation

Update the WP Visitor Statistics plugin to version 8.8 or later. Consider restricting access to the statistics dashboard to trusted IP addresses.

Other vulnerabilities in WP Visitor Statistics (Real Time Traffic) WordPress plugin

CVE-2026-117572Medium
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement. This allows high-privilege users such as administrators to perform SQL injection attacks.

Original NVD description (English source)

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a logged-in administrator views the statistics pages.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS