Who is not affected by CVE-2026-111370?

Q: Who is not affected by CVE-2026-111370?

Not affected if: fixed-version-installed, plugin-not-installed.

HIGH7.2CVSS · security@wordfence.com

NO KNOWN
EXPLOIT

WP-STATS-MANAGER · CVE-2026-111370 · Package

WP Visitor Statistics plugin: unauthenticated stored script injection via visitor parameters

FIX → 8.9.1

The WP Visitor Statistics (Real Time Traffic) WordPress plugin fails to sanitize the 'os', 'browser' and 'res' parameters, so unauthenticated visitors can store script in pages. Any user who opens an injected page runs that script in their browser.

first public Nov 7, 2026 · 2 sources

Check it with your coding agent

It checks your repository and tells you if you’re affected, with the fix.

01 · Who is affected

Any WordPress site running the WP Visitor Statistics (Real Time Traffic) plugin (slug wp-stats-manager) at 8.9.0 or older is in the CVE's range. An unauthenticated visitor can send crafted os, browser or res values to the plugin's tracker, and script stored there can run when someone views the page that shows it, such as an admin viewing the statistics. Sites without the plugin, or on 8.9.1 or newer, can skip it.

wp-stats-manager<= 8.9.0fixed in 8.9.1

Not affected if fixed-version-installed, plugin-not-installed

Who cares self-hosted, wordpress, wp-visitor-statistics

02 · How to check

The plugin's WordPress.org slug is wp-stats-manager (not wp-visitor-statistics). Run: wp plugin get wp-stats-manager --field=version
Or see Plugins > Installed Plugins in wp-admin. Version 8.9.0 or older is in the CVE's affected range; 8.9.1 or newer is not.
Stored values from earlier attacks may remain in the statistics tables (OS, browser, screen resolution), so after updating look at those reports for odd entries.

03 · The fix

Upgrade to 8.9.1

Update WP Visitor Statistics (Real Time Traffic) to 8.9.1 or later (Settings: Plugins > Updates). is the first release after the upper bound in the CVE.

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 7, 2026

How it unfolded

2 events · Nov 7, 2026 → Nov 7, 2026

Nov 7, 202612:47 UTCNVD CVE-2026-111370
Nov 7, 202612:52 UTCInfraStack Analyst NVD gave no fix. Plugin changelog (maintainer's page) shows 8.7.2 already fixed unauthenticated stored XSS via os/browser/res, and 8.9.1 hardened the OS/Browser/Resolution chart labels as a follow-up. So the CVE's <=8.9.0 range implies 8.9.1, but the changelog does not cite this CVE: fix version is inferred, not verified, and nothing marked verified. Also corrected the plugin slug in how-to-check. Wordfence advisory not read.moreless

What the sources say, verbatim

413 characters

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'os (also browser, res)' parameter in all versions up to, and including, 8.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Sources and references

NVD: CVE-2026-111370Nov 7, 2026
WP Visitor Statistics (Real Time Traffic) – WordPress.org plugin page and changelogFix · wordpress.org

This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.

Are you affected?

Tell InfraStack what you run. It checks this one, and every next one, against your stack.

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

In Slack

Run the check

Get the next Wp-stats-manager threat the day it hits your stack.

Start watching free

Post Share

HIGH7.2CVSS · security@wordfence.com

NO KNOWN
EXPLOIT

WP-STATS-MANAGER · CVE-2026-111370 · Package

WP Visitor Statistics plugin: unauthenticated stored script injection via visitor parameters

FIX → 8.9.1

first public Nov 7, 2026 · 2 sources

Check it with your coding agent

It checks your repository and tells you if you’re affected, with the fix.

01 · Who is affected

wp-stats-manager<= 8.9.0fixed in 8.9.1

Not affected if fixed-version-installed, plugin-not-installed

Who cares self-hosted, wordpress, wp-visitor-statistics

02 · How to check

The plugin's WordPress.org slug is wp-stats-manager (not wp-visitor-statistics). Run: wp plugin get wp-stats-manager --field=version
Or see Plugins > Installed Plugins in wp-admin. Version 8.9.0 or older is in the CVE's affected range; 8.9.1 or newer is not.
Stored values from earlier attacks may remain in the statistics tables (OS, browser, screen resolution), so after updating look at those reports for odd entries.

03 · The fix

Upgrade to 8.9.1

Update WP Visitor Statistics (Real Time Traffic) to 8.9.1 or later (Settings: Plugins > Updates). is the first release after the upper bound in the CVE.

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 7, 2026

How it unfolded

2 events · Nov 7, 2026 → Nov 7, 2026

Nov 7, 202612:47 UTCNVD CVE-2026-111370
Nov 7, 202612:52 UTCInfraStack Analyst NVD gave no fix. Plugin changelog (maintainer's page) shows 8.7.2 already fixed unauthenticated stored XSS via os/browser/res, and 8.9.1 hardened the OS/Browser/Resolution chart labels as a follow-up. So the CVE's <=8.9.0 range implies 8.9.1, but the changelog does not cite this CVE: fix version is inferred, not verified, and nothing marked verified. Also corrected the plugin slug in how-to-check. Wordfence advisory not read.moreless

What the sources say, verbatim

413 characters

Sources and references

NVD: CVE-2026-111370Nov 7, 2026
WP Visitor Statistics (Real Time Traffic) – WordPress.org plugin page and changelogFix · wordpress.org

This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.

Are you affected?

Tell InfraStack what you run. It checks this one, and every next one, against your stack.

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

In Slack

Run the check

Get the next Wp-stats-manager threat the day it hits your stack.

Start watching free

WP Visitor Statistics plugin: unauthenticated stored script injection via visitor parameters

01 · Who is affected

02 · How to check

03 · The fix

How it unfolded

What the sources say, verbatim

Sources and references

Read next

Get the next Wp-stats-manager threat the day it hits your stack.

WP Visitor Statistics plugin: unauthenticated stored script injection via visitor parameters

01 · Who is affected

02 · How to check

03 · The fix

How it unfolded

What the sources say, verbatim

Sources and references

Read next

Get the next Wp-stats-manager threat the day it hits your stack.