Live › vulnerability › CVE-2026-117571
The WP Visitor Statistics (Real Time Traffic) WordPress plugin stores tracking data from public visitor requests without sanitizing or escaping it. An unauthenticated attacker can inject web scripts that run in the browser of a logged-in administrator who opens the statistics pages, which can lead to admin account takeover.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 06:28 UTC. All times on this page are UTC.
Any WordPress site running the WP Visitor Statistics (Real Time Traffic) plugin before 8.8 is exposed, since the flaw is triggered by public visitor requests. Exploitation needs a logged-in administrator to view the statistics dashboard, so sites that do not use the plugin can skip it.
No product ranges from the sources yet.
wp-content/plugins/ for the Visitor Statistics plugin.8.8 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a logged-in administrator views the statistics pages.
This page as .md · .json · in your agent: get_signal("CVE-2026-117571")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.