{"id":"CVE-2026-117571","kind":"vulnerability","aliases":["CVE-2026-117571"],"related":[],"title":"WP Visitor Statistics plugin: visitor data lets attackers run scripts in admin","description":"The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a logged-in administrator views the statistics pages.","summary":"The WP Visitor Statistics (Real Time Traffic) WordPress plugin stores tracking data from public visitor requests without sanitizing or escaping it. An unauthenticated attacker can inject web scripts that run in the browser of a logged-in administrator who opens the statistics pages, which can lead to admin account takeover.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-visitor-statistics"],"not_affected_if":["plugin-8.8-or-later","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/` for the Visitor Statistics plugin.\n- Confirm whether the plugin is active on the site.","fix":"- Move the WP Visitor Statistics (Real Time Traffic) plugin to `8.8` or later.","status":"open","published_at":"2026-10-30T06:16:46+00:00","first_seen_at":"2026-10-30T06:28:39+00:00","triaged_at":"2026-10-30T06:30:04+00:00","updated_at":"2026-10-30T06:30:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T06:30:04Z","model":"claude-haiku-5-5","output":{"fix":"- Move the WP Visitor Statistics (Real Time Traffic) plugin to `8.8` or later.","reach":"internet","title":"WP Visitor Statistics plugin: visitor data lets attackers run scripts in admin","impact":"high","summary":"The WP Visitor Statistics (Real Time Traffic) WordPress plugin stores tracking data from public visitor requests without sanitizing or escaping it. An unauthenticated attacker can inject web scripts that run in the browser of a logged-in administrator who opens the statistics pages, which can lead to admin account takeover.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-visitor-statistics","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Admin browser runs attacker script, enabling admin account takeover","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/` for the Visitor Statistics plugin.\n- Confirm whether the plugin is active on the site.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-8.8-or-later"],"who_is_affected":"Any WordPress site running the WP Visitor Statistics (Real Time Traffic) plugin before 8.8 is exposed, since the flaw is triggered by public visitor requests. Exploitation needs a logged-in administrator to view the statistics dashboard, so sites that do not use the plugin can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000709,"input_tokens":4150,"output_tokens":588,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117571':15A,18A '-2026':14A,17A '8.8':89C 'account':77B 'admin':12A,76B 'administr':66B,110C,128C 'allow':113C 'arbitrari':118C 'attack':8A,51B,115C 'browser':60B 'cve':13A,16A 'dashboard':112C 'data':6A,39B,96C 'deriv':97C 'escap':47B,94C 'execut':122C 'host':22B 'inject':53B,117C 'lead':74B 'let':7A 'log':64B,126C 'logged-in':63B,125C 'open':68B 'output':106C 'packag':19B 'page':71B,132C 'plugin':4A,36B,87C 'public':41B,99C 'real':32B,83C 'request':43B,101C 'run':9A,57B 'sanit':45B,92C 'script':10A,55B,120C 'self':21B 'self-host':20B 'statist':3A,27B,31B,70B,82C,111C,131C 'store':37B,103C 'takeov':78B 'time':33B,84C 'track':38B,95C 'traffic':34B,85C 'unauthent':50B,114C 'view':129C 'visitor':2A,5A,26B,30B,42B,81C,100C 'web':54B,119C 'without':44B 'wordpress':23B,35B,86C 'wp':1A,25B,29B,80C 'wp-visitor-statist':24B","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running the WP Visitor Statistics (Real Time Traffic) plugin before 8.8 is exposed, since the flaw is triggered by public visitor requests. Exploitation needs a logged-in administrator to view the statistics dashboard, so sites that do not use the plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T06:16:46+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117571","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117571","severity":null,"published_at":"2026-10-30T06:16:46+00:00","modified_at":"2026-10-30T06:16:46+00:00","first_seen_at":"2026-10-30T06:28:39+00:00","fetched_at":"2026-10-30T06:28:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}