---
id: "CVE-2026-117571"
kind: "vulnerability"
aliases: ["CVE-2026-117571"]
title: "WP Visitor Statistics plugin: visitor data lets attackers run scripts in admin"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wp-visitor-statistics"]
not_affected_if: ["plugin-8.8-or-later", "plugin-not-installed"]
published_at: "2026-10-30T06:16:46+00:00"
first_seen_at: "2026-10-30T06:28:39+00:00"
updated_at: "2026-10-30T06:30:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117571", "first_seen_at": "2026-10-30T06:28:39+00:00"}]
---

# WP Visitor Statistics plugin: visitor data lets attackers run scripts in admin

The WP Visitor Statistics (Real Time Traffic) WordPress plugin stores tracking data from public visitor requests without sanitizing or escaping it. An unauthenticated attacker can inject web scripts that run in the browser of a logged-in administrator who opens the statistics pages, which can lead to admin account takeover.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/` for the Visitor Statistics plugin.
- Confirm whether the plugin is active on the site.

## Fix

- Move the WP Visitor Statistics (Real Time Traffic) plugin to `8.8` or later.

## Timeline

- 2026-10-30T06:28:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117571

## From the sources

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a logged-in administrator views the statistics pages.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_