CVE-2026-66430
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Subscriber SQL Injection vulnerability in Visitor Traffic Real Time Statistics Pro versions up to 11.10.
Risk Assessment
A user with subscriber role may inject malicious SQL queries, potentially leading to database compromise and data leakage.
Recommendation
Update the plugin to the latest version that includes a fix for the SQL Injection vulnerability.
Other vulnerabilities in Visitor Traffic Real Time Statistics Pro
See all- CVE-2026-90986High
An unauthenticated Cross-Site Scripting (XSS) vulnerability in Visitor Traffic Real Time Statistics Pro versions ≤ 11.21 allows attackers to inject malicious scripts without authentication.
- CVE-2026-57370High
The Visitor Traffic Real Time Statistics Pro plugin version 11.9.1 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
- CVE-2026-32479Critical
The Visitor Traffic Real Time Statistics Pro plugin versions up to 11.17 contain an unauthenticated SQL Injection vulnerability. An attacker can manipulate database queries, potentially leading to unauthorized data access.
- CVE-2026-66429High
Unauthenticated Cross Site Scripting (XSS) vulnerability in Visitor Traffic Real Time Statistics Pro versions up to 11.10.
Original NVD description (English source)
Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS