CVE-2026-117571
WP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker Device Parameters
- State
- Published
- Severity
- Not scored
- Published
- Oct 30, 2026
- Updated
- Oct 30, 2026
- Reserved
- Oct 27, 2026
Description
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a logged-in administrator views the statistics pages.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
WP Visitor Statistics (Real Time Traffic)Unknown |
|
References
- https://wpscan.com/vulnerability/088d6177-738f-4599-bd46-b4c725fb1cff/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.