CVE-2026-90986
HighCVSS 7.1Summary
An unauthenticated Cross-Site Scripting (XSS) vulnerability in Visitor Traffic Real Time Statistics Pro versions ≤ 11.21 allows attackers to inject malicious scripts without authentication.
Risk Assessment
Possible script execution in the victim's browser, potentially leading to session theft, account takeover, or phishing content.
Recommendation
Update the plugin to the latest patched version. Restrict access to the admin panel.
Other vulnerabilities in Visitor Traffic Real Time Statistics Pro
See all- CVE-2026-57370High
The Visitor Traffic Real Time Statistics Pro plugin version 11.9.1 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
- CVE-2026-32479Critical
The Visitor Traffic Real Time Statistics Pro plugin versions up to 11.17 contain an unauthenticated SQL Injection vulnerability. An attacker can manipulate database queries, potentially leading to unauthorized data access.
- CVE-2026-66430High
Subscriber SQL Injection vulnerability in Visitor Traffic Real Time Statistics Pro versions up to 11.10.
- CVE-2026-66429High
Unauthenticated Cross Site Scripting (XSS) vulnerability in Visitor Traffic Real Time Statistics Pro versions up to 11.10.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.21 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS