CVE-2026-97341
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to stored DOM-based cross-site scripting via the 'X-Real-IP' HTTP header in versions up to and including 8.16. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. The attack requires no authentication, nonce, or capability.
Risk Assessment
The risk involves potential execution of malicious scripts in users' browsers, which could lead to session theft, data theft, or further attacks. The attack can be performed by anyone without authentication.
Recommendation
Immediately update the Visitor Traffic Real Time Statistics plugin to the latest version with a fix. Also consider restricting access to the wp_ajax_nopriv_ahcfree_track_visitor endpoint.
Other vulnerabilities in Visitor Traffic Real Time Statistics
Original NVD description (English source)
The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header in all versions up to, and including, 8.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires no authentication, no nonce, and no capability — the wp_ajax_nopriv_ahcfree_track_visitor endpoint accepts the forged X-Real-IP header from any unauthenticated HTTP request and stores the entity-encoded payload verbatim in the database.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS