---
id: "CVE-2026-109230"
page: "https://infrastack.ai/live/CVE-2026-109230"
kind: "vulnerability"
aliases: ["CVE-2026-109230"]
title: "WP Visitor Statistics plugin: unauthenticated stored script injection via tracking endpoint"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "wp-stats-manager", "fixed": ["8.7.2"], "affected": "<= 8.7.1", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "wordpress", "wp-visitor-statistics"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-07T12:17:42+00:00"
first_seen_at: "2026-11-07T12:47:08+00:00"
updated_at: "2026-11-07T12:52:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109230", "first_seen_at": "2026-11-07T12:47:08+00:00"}, {"source": "analyst", "url": "https://wordpress.org/plugins/wp-stats-manager/", "first_seen_at": "2026-11-07T12:52:35+00:00", "cites": ["https://wordpress.org/plugins/wp-stats-manager/"]}]
exploit_sources: []
---

# WP Visitor Statistics plugin: unauthenticated stored script injection via tracking endpoint

Link for people: https://infrastack.ai/live/CVE-2026-109230 (this .md is for agents)

The WP Visitor Statistics (Real Time Traffic) WordPress plugin, up to and including 8.7.1, does not sanitize the 'browser' parameter sent to its public tracking endpoint. An unauthenticated attacker can store JavaScript that runs in the browser of an administrator who views the statistics.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:wp-stats-manager affected <= 8.7.1 fixed 8.7.2

## How to check

- In WordPress admin > Plugins, check WP Visitor Statistics (Real Time Traffic) (slug wp-stats-manager); 8.7.1 or lower is affected, 8.7.2+ is fixed.
- Or read wp-content/plugins/wp-stats-manager/readme.txt for the Stable tag.
- After updating, review stored OS/browser/resolution statistics for script content that was injected earlier.

## Fix

Update WP Visitor Statistics (Real Time Traffic) to 8.7.2 or later (8.9.1 is current per changelog)

## Timeline

- 2026-11-07T12:47:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109230
- 2026-11-07T12:52:35+00:00 analyst https://wordpress.org/plugins/wp-stats-manager/ — Maintainer changelog on WordPress.org (slug wp-stats-manager) lists 8.7.2 as fixing unauthenticated stored XSS via tracker os/browser/res params; 8.9.1 adds follow-up hardening. NVD page not readable. Exploitation/PoC not checked; no social search (B tier). Sibling CVE-2026-111370 likely same fix.

## Documents

- [fix] WP Visitor Statistics (Real Time Traffic) – WordPress.org plugin page and changelog https://wordpress.org/plugins/wp-stats-manager/

## From the sources

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'browser' parameter in all versions up to, and including, 8.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored via an unauthenticated HTTP request to the public visitor tracking endpoint (wmcAction=wmcTrack) and executes when the bundled jqPlot PieRenderer inserts the HTML-decoded series label directly as HTML in the authenticated administrator's browser.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_