WP Visitor Statistics (Real Time Traffic): Stored Cross-Site Scripting
Summary
The WordPress plugin WP Visitor Statistics (Real Time Traffic) does not sanitize and escape tracking data taken from public visitor requests before storing and displaying it in the admin statistics dashboard. An unauthenticated attacker can inject JavaScript that runs in the browser of a logged-in administrator who views the statistics pages, which can lead to session hijacking or site takeover. The CVE record rates this as CVSS 8.8, but VulDB lists 4.3 and the score has not been verified from a primary source.
Affected
- WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 (CVE record)
- VulDB describes the range as up to 8.7; check the installed version yourself
- WordPress.org slug: wp-stats-manager
Fixed in
- Version 8.8 (per WPScan and OffSeq)
- Unknown whether 8.8 fully resolves all related issues; this is still to be checked against the 8.8 code
Workaround
- No vendor workaround; the patch is the fix.
- Until 8.8 is installed: limit who can open the statistics dashboard, avoid viewing it while logged in to other sensitive admin areas, and consider a WAF rule if available.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No evidence of exploitation in the wild; not listed in KEV.
- No public exploit code or nuclei template found (snapshot from 30 Oct 2026).
Our recommendation
- Update the plugin to version 8.8 or later on every WordPress site where it is installed.
- Check all sites for this plugin, as it is easy to overlook.
- Until the update, restrict dashboard access and have administrators avoid viewing the statistics while logged in to other admin areas.
- Review admin accounts and sessions for unexpected activity if the dashboard was viewed while exposed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability record wpscan.com
- VulDB 428951 vuldb.com
- OffSeq Threat Radar (CVE-2026-117571) radar.offseq.com
- OffSeq Threat Radar (before 8.8 fix) radar.offseq.com
- Strix CVE record www.strix.ai
- CVE threat intelligence record cve.threatint.com
- WordPress.org plugin page wordpress.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:46.
Original description (NVD)
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a logged-in administrator views the statistics pages.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.