[ CVE-2026-117571 · Published 30 Oct 2026 ]
Vulnerability in Unknown WP Visitor Statistics (Real Time Traffic)
CVSS 8.8
EPSS <1%No fix listed yet
[ Description ]Official description
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a logged-in administrator views the statistics pages.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.