What is the CVSS score of CVE-2025-49400?

CVE-2025-49400 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WP Visitor Statistics are affected by CVE-2025-49400?

A critical stored cross-site scripting vulnerability in WP Visitor Statistics plugin (versions ≤8.2) allows unauthenticated attackers to inject malicious scripts into WordPress databases, potentially…

How to fix or mitigate CVE-2025-49400?

Within 24 hours: Audit all WordPress installations for WP Visitor Statistics plugin presence and document affected sites. Within 7 days: Immediately deactivate and remove WP Visitor Statistics plugin versions ≤8.2 from all WordPress sites; migrate visitor tracking functionality to an alternative plugin or tool not affected by this vulnerability. Within 30 days: Review WordPress user activity logs and database for signs of injected scripts; reset credentials for all administrative accounts; implement content security policy (CSP) headers to mitigate stored XSS impact on remaining plugins.

WP Visitor Statistics CVE-2025-49400

CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2025-08-20 audit@patchstack.com

XSS

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 28, 2026 - 19:59 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Severity Changed

Apr 23, 2026 - 15:42 NVD

MEDIUM CRITICAL

CVSS changed

Apr 23, 2026 - 15:42 NVD

6.5 (MEDIUM) 9.8 (CRITICAL)

Analysis Generated

Mar 28, 2026 - 19:07 vuln.today

CVE Published

Aug 20, 2025 - 08:15 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) allows Stored XSS. This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through 8.2.

AnalysisAI

Stored cross-site scripting in WP Visitor Statistics (Real Time Traffic) plugin versions ≤8.2 allows remote unauthenticated attackers to inject malicious scripts into the WordPress database, leading to credential theft, session hijacking, or administrative account compromise. Reported by Patchstack's security team with EPSS exploitation probability of only 0.03% (8th percentile), indicating extremely low observed exploitation likelihood despite the critical CVSS 9.8 rating. No CISA KEV listing or public POC identified at time of analysis.

Technical ContextAI

This vulnerability stems from improper input validation and output encoding (CWE-79) in the WP Visitor Statistics (Real Time Traffic) WordPress plugin. The plugin fails to sanitize user-supplied data before storing it in the WordPress database and rendering it in administrative or public-facing pages. Stored XSS (also called persistent XSS) is particularly dangerous because the malicious payload remains in the database and executes whenever the compromised data is displayed, affecting multiple users over time rather than requiring per-victim social engineering. The vulnerability exists in versions up to and including 8.2, affecting WordPress installations with this plugin active.

Affected ProductsAI

WordPress sites running WP Visitor Statistics (Real Time Traffic) plugin by osama.esh, versions 8.2 and earlier. The vulnerability affects all installations of this plugin within the specified version range. Patchstack advisory available at https://patchstack.com/database/wordpress/plugin/wp-stats-manager/vulnerability/wordpress-wp-visitor-statistics-real-time-traffic-plugin-8-2-cross-site-scripting-xss-vulnerability. Note that the second reference URL appears to reference an unrelated plugin (PressApps Knowledge Base) and may be a data correlation error in the NVD record.

RemediationAI

Upgrade WP Visitor Statistics (Real Time Traffic) plugin to version 8.3 or later if available, or remove the plugin entirely if not business-critical. Check the WordPress.org plugin repository or contact the developer osama.esh for the patched release. If immediate upgrade is not feasible, implement these compensating controls with noted trade-offs: (1) Restrict WordPress administrative dashboard access to trusted IP addresses via .htaccess or firewall rules (limits operational flexibility for remote administrators). (2) Implement Content Security Policy headers to block inline script execution (may break legitimate plugin functionality that relies on inline JavaScript). (3) Disable the plugin temporarily and use alternative visitor statistics tools like Jetpack Stats or Google Analytics (loses real-time traffic visibility within WordPress). (4) Review stored visitor data in the plugin's database tables for suspicious HTML/JavaScript content and sanitize manually (labor-intensive and requires database expertise). Advisory details: https://patchstack.com/database/wordpress/plugin/wp-stats-manager/vulnerability/wordpress-wp-visitor-statistics-real-time-traffic-plugin-8-2-cross-site-scripting-xss-vulnerability.