CVE-2026-57370
HighCVSS 7.1Summary
The Visitor Traffic Real Time Statistics Pro plugin version 11.9.1 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
Risk Assessment
Risk includes session hijacking, redirection to malicious sites, or theft of sensitive data. The attack does not require authentication, increasing the attack surface.
Recommendation
Immediately update the Visitor Traffic Real Time Statistics Pro plugin to the latest available version. Also consider deploying a Web Application Firewall (WAF) to block common XSS patterns.
Other vulnerabilities in Visitor Traffic Real Time Statistics Pro
See all- CVE-2026-32479Critical
The Visitor Traffic Real Time Statistics Pro plugin versions up to 11.17 contain an unauthenticated SQL Injection vulnerability. An attacker can manipulate database queries, potentially leading to unauthorized data access.
- CVE-2026-66430High
Subscriber SQL Injection vulnerability in Visitor Traffic Real Time Statistics Pro versions up to 11.10.
- CVE-2026-66429High
Unauthenticated Cross Site Scripting (XSS) vulnerability in Visitor Traffic Real Time Statistics Pro versions up to 11.10.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.9.1 versions.