WP Visitor Statistics CVE-2026-117571

The target must be running the WP Visitor Statistics (Real Time Traffic) plugin at any version before 8.8 with its visitor-tracking/statistics feature active (its core function). The attacker needs no authentication and simply issues public visitor requests whose tracking-derived data (the specific field - e.g. referrer or user-agent - is not stated in the available sources) carries the script payload. Exploitation is gated by required administrator interaction (UI:R): the injected script only executes when a logged-in administrator views the statistics/dashboard pages, so there is a delay and dependence on admin behavior, and no payload fires against anonymous or non-admin visitors.

Signals are mixed and point to a moderate, not emergency, priority. The input CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms a network-reachable, low-complexity, unauthenticated injection whose execution depends on administrator interaction (UI:R), and SSVC records Technical Impact as 'total' - consistent with script execution in an authenticated admin session that can lead to full site control. Against that, exploitation-likelihood signals are low: EPSS is 0.17% (7th percentile), SSVC Exploitation is 'none' and Automatable is 'no', and no exploitation is claimed. The vuln.today decision label is 'this_week' rather than act_now/emergency. The headline 8.8 is driven by C:H/I:H/A:H impact metrics that are generous for a stored XSS; the realistic impact is admin-session compromise contingent on an admin viewing the statistics dashboard, so this is a genuine but second-tier priority rather than a mass-exploited critical. Conflict to note explicitly: the input marks Scope Unchanged (S:U) with full C/I/A:H, yet classic reflected-to-admin stored XSS normally involves a scope change and lower direct impact - the 8.8 appears impact-inflated relative to the described mechanism.

An unauthenticated attacker sends normal-looking public requests to a site running WP Visitor Statistics before 8.8, embedding a malicious script payload in attacker-controlled tracking fields (such as referrer or user-agent). The plugin stores this data without sanitization, and when a logged-in administrator later opens the statistics dashboard the script executes in the admin's authenticated browser session, enabling session/account takeover and further site compromise. No public exploit was identified in the provided data, and administrator interaction (UI:R) is required for the payload to fire.