WP-STATS-MANAGER · CVE-2026-109230 · Package
FIX → 8.7.2 ✓ verified
The WP Visitor Statistics (Real Time Traffic) WordPress plugin, up to and including 8.7.1, does not sanitize the 'browser' parameter sent to its public tracking endpoint. An unauthenticated attacker can store JavaScript that runs in the browser of an administrator who views the statistics.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the WP Visitor Statistics (Real Time Traffic) plugin at version 8.7.1 or earlier. The payload is stored through a public, unauthenticated request, and it fires when an administrator views the plugin's statistics, so exposure depends on an admin using the plugin's pages. Sites without the plugin installed are not affected.
Not affected if plugin-not-installed
Who cares wordpress, wp-visitor-statistics
Upgrade to 8.7.2
Update WP Visitor Statistics (Real Time Traffic) to 8.7.2 or later ( is current per changelog)
The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'browser' parameter in all versions up to, and including, 8.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored via an unauthenticated HTTP request to the public visitor tracking endpoint (wmcAction=wmcTrack) and executes when the bundled jqPlot PieRenderer inserts the HTML-decoded series label directly as HTML in the authenticated administrator's browser.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
8.9.1