{"id":"CVE-2026-109230","kind":"vulnerability","aliases":["CVE-2026-109230"],"related":[],"title":"WP Visitor Statistics plugin: unauthenticated stored script injection via tracking endpoint","description":"The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'browser' parameter in all versions up to, and including, 8.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored via an unauthenticated HTTP request to the public visitor tracking endpoint (wmcAction=wmcTrack) and executes when the bundled jqPlot PieRenderer inserts the HTML-decoded series label directly as HTML in the authenticated administrator's browser.","summary":"The WP Visitor Statistics (Real Time Traffic) WordPress plugin, up to and including 8.7.1, does not sanitize the 'browser' parameter sent to its public tracking endpoint. An unauthenticated attacker can store JavaScript that runs in the browser of an administrator who views the statistics.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wp-stats-manager","fixed":["8.7.2"],"affected":"<= 8.7.1","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","wordpress","wp-visitor-statistics"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- In WordPress admin > Plugins, check WP Visitor Statistics (Real Time Traffic) (slug wp-stats-manager); 8.7.1 or lower is affected, 8.7.2+ is fixed.\n- Or read wp-content/plugins/wp-stats-manager/readme.txt for the Stable tag.\n- After updating, review stored OS/browser/resolution statistics for script content that was injected earlier.","fix":"Update WP Visitor Statistics (Real Time Traffic) to 8.7.2 or later (8.9.1 is current per changelog)","status":"open","published_at":"2026-11-07T12:17:42+00:00","first_seen_at":"2026-11-07T12:47:08+00:00","triaged_at":"2026-11-07T12:48:56+00:00","updated_at":"2026-11-07T12:52:35+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-07T12:48:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WP Visitor Statistics plugin: unauthenticated stored script injection via tracking endpoint","impact":"medium","summary":"The WP Visitor Statistics (Real Time Traffic) WordPress plugin, up to and including 8.7.1, does not sanitize the 'browser' parameter sent to its public tracking endpoint. An unauthenticated attacker can store JavaScript that runs in the browser of an administrator who views the statistics.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-visitor-statistics"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker script runs in an administrator's browser, enabling account takeover.","analyst_note":"Confirm the first patched version from the plugin's changelog or the WordPress.org plugin page; NVD gave no fixed version.","how_to_check":"- Check the installed version of the WP Visitor Statistics (Real Time Traffic) plugin in the WordPress admin plugin list; versions up to and including `8.7.1` are affected.\n- Look for the plugin directory and confirm whether the `wmcAction=wmcTrack` tracking endpoint is reachable on the public site.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WP Visitor Statistics (Real Time Traffic) plugin at version 8.7.1 or earlier. The payload is stored through a public, unauthenticated request, and it fires when an administrator views the plugin's statistics, so exposure depends on an admin using the plugin's pages. Sites without the plugin installed are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000757,"input_tokens":4376,"output_tokens":638,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the first patched version from the plugin's changelog or the WordPress.org plugin page; NVD gave no fixed version.","search":"'-109230':14A,17A '-2026':13A,16A '8.7.1':41B,101C 'access':130C 'administr':67B,171C 'arbitrari':119C 'attack':56B,116C 'authent':170C 'browser':46B,64B,92C,173C 'bundl':155C 'cross':87C 'cross-sit':86C 'cve':12A,15A 'decod':162C 'direct':165C 'due':102C 'endpoint':11A,53B,148C 'escap':109C 'execut':126C,152C 'html':161C,167C 'html-decod':160C 'http':141C 'includ':40B,100C 'inject':8A,118C,132C 'input':105C 'insert':158C 'insuffici':104C 'javascript':59B 'jqplot':156C 'label':164C 'make':111C 'manager':21A 'output':108C 'packag':22B 'page':123C,133C 'paramet':47B,93C 'payload':135C 'pierender':157C 'plugin':4A,36B,79C 'possibl':113C 'public':51B,145C 'real':32B,76C 'request':142C 'run':61B 'sanit':44B,106C 'script':7A,89C,121C 'sent':48B 'seri':163C 'site':88C 'statist':3A,27B,31B,71B,75C 'stats':20A 'store':6A,58B,85C,137C 'time':33B,77C 'track':10A,52B,147C 'traffic':34B,78C 'unauthent':5A,55B,115C,140C 'user':129C 'version':96C 'via':9A,90C,138C 'view':69B 'visitor':2A,26B,30B,74C,146C 'vulner':83C 'web':120C 'whenev':127C 'wmcaction':149C 'wmctrack':150C 'wordpress':23B,35B,81C 'wp':1A,19A,25B,29B,73C 'wp-stats-manager':18A 'wp-visitor-statist':24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Visitor Statistics (Real Time Traffic) plugin at version 8.7.1 or earlier. The payload is stored through a public, unauthenticated request, and it fires when an administrator views the plugin's statistics, so exposure depends on an admin using the plugin's pages. Sites without the plugin installed are not affected.","tier":"B","verified":{"fix":{"at":"2026-11-07T12:52:35Z","by":"analyst","doc":"https://wordpress.org/plugins/wp-stats-manager/","run_id":2119}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["wpstatsmanager"],"ptokens":["manager","stats","wp"],"labels":["high","package","wordpress","wpvisitorstatistics"],"campaign_type":null,"search_a":"'-109230':14A,17A '-2026':13A,16A 'cve':12A,15A 'endpoint':11A 'inject':8A 'manager':21A 'plugin':4A 'script':7A 'statist':3A 'stats':20A 'store':6A 'track':10A 'unauthent':5A 'via':9A 'visitor':2A 'wp':1A,19A 'wp-stats-manager':18A","search_b":"'8.7.1':41B 'administr':67B 'attack':56B 'browser':46B,64B 'endpoint':53B 'includ':40B 'javascript':59B 'packag':22B 'paramet':47B 'plugin':36B 'public':51B 'real':32B 'run':61B 'sanit':44B 'sent':48B 'statist':27B,31B,71B 'store':58B 'time':33B 'track':52B 'traffic':34B 'unauthent':55B 'view':69B 'visitor':26B,30B 'wordpress':23B,35B 'wp':25B,29B 'wp-visitor-statist':24B","search_c":"'8.7.1':101C 'access':130C 'administr':171C 'arbitrari':119C 'attack':116C 'authent':170C 'browser':92C,173C 'bundl':155C 'cross':87C 'cross-sit':86C 'decod':162C 'direct':165C 'due':102C 'endpoint':148C 'escap':109C 'execut':126C,152C 'html':161C,167C 'html-decod':160C 'http':141C 'includ':100C 'inject':118C,132C 'input':105C 'insert':158C 'insuffici':104C 'jqplot':156C 'label':164C 'make':111C 'output':108C 'page':123C,133C 'paramet':93C 'payload':135C 'pierender':157C 'plugin':79C 'possibl':113C 'public':145C 'real':76C 'request':142C 'sanit':106C 'script':89C,121C 'seri':163C 'site':88C 'statist':75C 'store':85C,137C 'time':77C 'track':147C 'traffic':78C 'unauthent':115C,140C 'user':129C 'version':96C 'via':90C,138C 'visitor':74C,146C 'vulner':83C 'web':120C 'whenev':127C 'wmcaction':149C 'wmctrack':150C 'wordpress':81C 'wp':73C","first_public_at":"2026-11-07T12:17:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109230","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109230","severity":null,"published_at":"2026-11-07T12:17:42+00:00","modified_at":"2026-11-07T12:17:42+00:00","first_seen_at":"2026-11-07T12:47:08+00:00","fetched_at":"2026-11-07T12:47:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109230:2119","url":"https://wordpress.org/plugins/wp-stats-manager/","severity":null,"published_at":"2026-11-07T12:52:35+00:00","modified_at":"2026-11-07T12:52:35+00:00","first_seen_at":"2026-11-07T12:52:35+00:00","fetched_at":"2026-11-07T12:52:35+00:00","note":"Maintainer changelog on WordPress.org (slug wp-stats-manager) lists 8.7.2 as fixing unauthenticated stored XSS via tracker os/browser/res params; 8.9.1 adds follow-up hardening. NVD page not readable. Exploitation/PoC not checked; no social search (B tier). Sibling CVE-2026-111370 likely same fix.","cites":["https://wordpress.org/plugins/wp-stats-manager/"]}],"documents":[{"id":95564,"url":"https://wordpress.org/plugins/wp-stats-manager/","title":"WP Visitor Statistics (Real Time Traffic) – WordPress.org plugin page and changelog","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}