---
id: "CVE-2026-111370"
page: "https://infrastack.ai/live/CVE-2026-111370"
kind: "vulnerability"
aliases: ["CVE-2026-111370"]
title: "WP Visitor Statistics plugin: unauthenticated stored script injection via visitor parameters"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "wp-stats-manager", "fixed": ["8.9.1"], "affected": "<= 8.9.0", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wp-visitor-statistics"]
not_affected_if: ["fixed-version-installed", "plugin-not-installed"]
published_at: "2026-11-07T12:17:42+00:00"
first_seen_at: "2026-11-07T12:47:08+00:00"
updated_at: "2026-11-07T12:52:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111370", "first_seen_at": "2026-11-07T12:47:08+00:00"}, {"source": "analyst", "url": "https://wordpress.org/plugins/wp-stats-manager/", "first_seen_at": "2026-11-07T12:52:13+00:00", "cites": ["https://wordpress.org/plugins/wp-stats-manager/"]}]
exploit_sources: []
---

# WP Visitor Statistics plugin: unauthenticated stored script injection via visitor parameters

Link for people: https://infrastack.ai/live/CVE-2026-111370 (this .md is for agents)

The WP Visitor Statistics (Real Time Traffic) WordPress plugin fails to sanitize the 'os', 'browser' and 'res' parameters, so unauthenticated visitors can store script in pages. Any user who opens an injected page runs that script in their browser.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:wp-stats-manager affected <= 8.9.0 fixed 8.9.1

## How to check

- The plugin's WordPress.org slug is wp-stats-manager (not wp-visitor-statistics). Run: wp plugin get wp-stats-manager --field=version
- Or see Plugins > Installed Plugins in wp-admin. Version 8.9.0 or older is in the CVE's affected range; 8.9.1 or newer is not.
- Stored values from earlier attacks may remain in the statistics tables (OS, browser, screen resolution), so after updating look at those reports for odd entries.

## Fix

Update WP Visitor Statistics (Real Time Traffic) to 8.9.1 or later (Settings: Plugins > Updates). 8.9.1 is the first release after the 8.9.0 upper bound in the CVE.

## Timeline

- 2026-11-07T12:47:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111370
- 2026-11-07T12:52:13+00:00 analyst https://wordpress.org/plugins/wp-stats-manager/ — NVD gave no fix. Plugin changelog (maintainer's page) shows 8.7.2 already fixed unauthenticated stored XSS via os/browser/res, and 8.9.1 hardened the OS/Browser/Resolution chart labels as a follow-up. So the CVE's <=8.9.0 range implies 8.9.1, but the changelog does not cite this CVE: fix version is inferred, not verified, and nothing marked verified. Also corrected the plugin slug in how-to-check. Wordfence advisory not read.

## Documents

- [fix] WP Visitor Statistics (Real Time Traffic) – WordPress.org plugin page and changelog https://wordpress.org/plugins/wp-stats-manager/

## From the sources

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'os (also browser, res)' parameter in all versions up to, and including, 8.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_