CVE-2026-117572

8th percentile - higher than 8% of all known CVEs

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement. This allows high-privilege users such as administrators to perform SQL injection attacks.

Data in the database could be read or modified through an administrator account, potentially leading to data leakage or further privilege escalation.

Update the WP Visitor Statistics plugin to version 8.8 or later. Minimize the number of administrative accounts.