{"id":"CVE-2026-111370","kind":"vulnerability","aliases":["CVE-2026-111370"],"related":[],"title":"WP Visitor Statistics plugin: unauthenticated stored script injection via visitor parameters","description":"The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'os (also browser, res)' parameter in all versions up to, and including, 8.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","summary":"The WP Visitor Statistics (Real Time Traffic) WordPress plugin fails to sanitize the 'os', 'browser' and 'res' parameters, so unauthenticated visitors can store script in pages. Any user who opens an injected page runs that script in their browser.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wp-stats-manager","fixed":["8.9.1"],"affected":"<= 8.9.0","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-visitor-statistics"],"not_affected_if":["fixed-version-installed","plugin-not-installed"],"how_to_check":"- The plugin's WordPress.org slug is wp-stats-manager (not wp-visitor-statistics). Run: wp plugin get wp-stats-manager --field=version\n- Or see Plugins > Installed Plugins in wp-admin. Version 8.9.0 or older is in the CVE's affected range; 8.9.1 or newer is not.\n- Stored values from earlier attacks may remain in the statistics tables (OS, browser, screen resolution), so after updating look at those reports for odd entries.","fix":"Update WP Visitor Statistics (Real Time Traffic) to 8.9.1 or later (Settings: Plugins > Updates). 8.9.1 is the first release after the 8.9.0 upper bound in the CVE.","status":"open","published_at":"2026-11-07T12:17:42+00:00","first_seen_at":"2026-11-07T12:47:08+00:00","triaged_at":"2026-11-07T12:48:53+00:00","updated_at":"2026-11-07T12:52:13+00:00","category":"package","confidence":0.65,"triage":{"at":"2026-11-07T12:48:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WP Visitor Statistics plugin: unauthenticated stored script injection via visitor parameters","impact":"medium","summary":"The WP Visitor Statistics (Real Time Traffic) WordPress plugin fails to sanitize the 'os', 'browser' and 'res' parameters, so unauthenticated visitors can store script in pages. Any user who opens an injected page runs that script in their browser.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-visitor-statistics","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"visitors' browsers run attacker script on injected pages","analyst_note":"Confirm the fixed version and vendor advisory on the NVD entry or the plugin's changelog; the sources give no fix version.","how_to_check":"- Check whether the WP Visitor Statistics (Real Time Traffic) plugin is installed and its version, e.g. `wp plugin get wp-visitor-statistics --field=version` if WP-CLI is available\n- Confirm the installed version is `8.9.0` or older, which the advisory lists as vulnerable","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Any WordPress site running the WP Visitor Statistics (Real Time Traffic) plugin at version 8.9.0 or older is exposed, because the flaw is reachable by unauthenticated visitors through the statistics parameters. Sites that do not have the plugin installed, or run a newer version, are not affected. The sources do not state a fixed version.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000738,"input_tokens":4285,"output_tokens":618,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and vendor advisory on the NVD entry or the plugin's changelog; the sources give no fix version.","search":"'-111370':14A,17A '-2026':13A,16A '8.9.0':102C 'access':131C 'also':91C 'arbitrari':120C 'attack':117C 'browser':45B,69B,92C 'cross':85C 'cross-sit':84C 'cve':12A,15A 'due':103C 'escap':110C 'execut':127C 'fail':40B 'host':25B 'includ':101C 'inject':8A,62B,119C,133C 'input':106C 'insuffici':105C 'make':112C 'manager':21A 'open':60B 'os':44B,90C 'output':109C 'packag':22B 'page':56B,63B,124C,134C 'paramet':11A,48B,94C 'plugin':4A,39B,77C 'possibl':114C 'real':35B,74C 'res':47B,93C 'run':64B 'sanit':42B,107C 'script':7A,54B,66B,87C,122C 'self':24B 'self-host':23B 'site':86C 'statist':3A,30B,34B,73C 'stats':20A 'store':6A,53B,83C 'time':36B,75C 'traffic':37B,76C 'unauthent':5A,50B,116C 'user':58B,130C 'version':97C 'via':9A,88C 'visitor':2A,10A,29B,33B,51B,72C 'vulner':81C 'web':121C 'whenev':128C 'wordpress':26B,38B,79C 'wp':1A,19A,28B,32B,71C 'wp-stats-manager':18A 'wp-visitor-statist':27B","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running the WP Visitor Statistics (Real Time Traffic) plugin (slug wp-stats-manager) at 8.9.0 or older is in the CVE's range. An unauthenticated visitor can send crafted os, browser or res values to the plugin's tracker, and script stored there can run when someone views the page that shows it, such as an admin viewing the statistics. Sites without the plugin, or on 8.9.1 or newer, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["wpstatsmanager"],"ptokens":["manager","stats","wp"],"labels":["high","package","selfhosted","wordpress","wpvisitorstatistics"],"campaign_type":null,"search_a":"'-111370':14A,17A '-2026':13A,16A 'cve':12A,15A 'inject':8A 'manager':21A 'paramet':11A 'plugin':4A 'script':7A 'statist':3A 'stats':20A 'store':6A 'unauthent':5A 'via':9A 'visitor':2A,10A 'wp':1A,19A 'wp-stats-manager':18A","search_b":"'browser':45B,69B 'fail':40B 'host':25B 'inject':62B 'open':60B 'os':44B 'packag':22B 'page':56B,63B 'paramet':48B 'plugin':39B 'real':35B 'res':47B 'run':64B 'sanit':42B 'script':54B,66B 'self':24B 'self-host':23B 'statist':30B,34B 'store':53B 'time':36B 'traffic':37B 'unauthent':50B 'user':58B 'visitor':29B,33B,51B 'wordpress':26B,38B 'wp':28B,32B 'wp-visitor-statist':27B","search_c":"'8.9.0':102C 'access':131C 'also':91C 'arbitrari':120C 'attack':117C 'browser':92C 'cross':85C 'cross-sit':84C 'due':103C 'escap':110C 'execut':127C 'includ':101C 'inject':119C,133C 'input':106C 'insuffici':105C 'make':112C 'os':90C 'output':109C 'page':124C,134C 'paramet':94C 'plugin':77C 'possibl':114C 'real':74C 'res':93C 'sanit':107C 'script':87C,122C 'site':86C 'statist':73C 'store':83C 'time':75C 'traffic':76C 'unauthent':116C 'user':130C 'version':97C 'via':88C 'visitor':72C 'vulner':81C 'web':121C 'whenev':128C 'wordpress':79C 'wp':71C","first_public_at":"2026-11-07T12:17:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111370","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111370","severity":null,"published_at":"2026-11-07T12:17:42+00:00","modified_at":"2026-11-07T12:17:42+00:00","first_seen_at":"2026-11-07T12:47:08+00:00","fetched_at":"2026-11-07T12:47:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111370:2117","url":"https://wordpress.org/plugins/wp-stats-manager/","severity":null,"published_at":"2026-11-07T12:52:13+00:00","modified_at":"2026-11-07T12:52:13+00:00","first_seen_at":"2026-11-07T12:52:13+00:00","fetched_at":"2026-11-07T12:52:13+00:00","note":"NVD gave no fix. Plugin changelog (maintainer's page) shows 8.7.2 already fixed unauthenticated stored XSS via os/browser/res, and 8.9.1 hardened the OS/Browser/Resolution chart labels as a follow-up. So the CVE's <=8.9.0 range implies 8.9.1, but the changelog does not cite this CVE: fix version is inferred, not verified, and nothing marked verified. Also corrected the plugin slug in how-to-check. Wordfence advisory not read.","cites":["https://wordpress.org/plugins/wp-stats-manager/"]}],"documents":[{"id":95564,"url":"https://wordpress.org/plugins/wp-stats-manager/","title":"WP Visitor Statistics (Real Time Traffic) – WordPress.org plugin page and changelog","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}