What is the CVSS score of CVE-2026-28175?

CVE-2026-28175 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Visitors Traffic Real Time Statistics are affected by CVE-2026-28175?

The Visitors Traffic Real Time Statistics WordPress plugin (versions 8.11 and below) contains an unauthenticated cross-site scripting vulnerability that affects thousands of WordPress sites, enabling…

How to fix or mitigate CVE-2026-28175?

Within 24 hours, scan all WordPress installations for the Visitors Traffic Real Time Statistics plugin version 8.11 and below and immediately disable it; inventory affected systems and alert site administrators of the risk and interim protections. Within 7 days, deploy Web Application Firewall rules to block XSS payloads targeting this plugin's known injection points, implement strict Content Security Policy headers, enforce two-factor authentication on all WordPress administrative accounts, and configure audit logging to detect unauthorized administrator activity or account creation. Within 30 days, establish vendor communication with wp-buy regarding patch availability and timeline; upon release of a patched version, immediately test in staging and deploy to all production WordPress instances, prioritizing high-value sites with sensitive data or critical functionality.

Visitors Traffic Real Time Statistics CVE-2026-28175

EUVD-2026-57958 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-13 Patchstack

GHSA-cxmp-fp83-fp77

WordPress XSS Wordpress Plugin Visitors Traffic Real Time Statistics Wp Buy

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Standard reflected/stored XSS: network vector, no privileges, requires victim interaction, scope changes to browser; no availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:53 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions.

AnalysisAI

Unauthenticated cross-site scripting in the WordPress plugin Visitors Traffic Real Time Statistics (versions 8.11 and below, by vendor wp-buy) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages served to authenticated WordPress users. The CVSS vector (S:C) confirms the scope crosses from the plugin's execution context into the victim's browser session, enabling session hijacking, credential theft, or admin takeover. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the unauthenticated, low-complexity attack surface warrants prompt patching given the wide WordPress ecosystem.

Technical ContextAI

The affected product is a WordPress plugin (CPE: cpe:2.3:a:wp-buy:visitors_traffic_real_time_statistics:*:*:*:*:*:*:*:*) developed by wp-buy, designed to track and display real-time visitor analytics within WordPress admin dashboards or front-end widgets. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting): attacker-controlled input, likely from HTTP request parameters or visitor-logged data fields, is rendered in HTML output without adequate encoding or sanitization. The 'Unauthenticated' qualifier in the description implies the injection vector does not require the attacker to hold a WordPress account, meaning the payload can be seeded by any external HTTP request. The CVSS scope-change metric (S:C) is consistent with reflected or stored XSS where injected code executes in a different security origin - the victim's browser - than where it was introduced.

RemediationAI

The primary remediation is to upgrade the Visitors Traffic Real Time Statistics plugin beyond version 8.11 via the WordPress admin plugin update interface or the WordPress.org plugin repository. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/visitors-traffic-real-time-statistics/vulnerability/wordpress-visitors-traffic-real-time-statistics-plugin-8-11-cross-site-scripting-xss-vulnerability should be consulted for the exact patched version number, which was not independently confirmed in the available source data. If an immediate upgrade is not feasible, a compensating control is to deactivate and remove the plugin entirely, which eliminates the attack surface at the cost of losing visitor traffic analytics functionality. Alternatively, a web application firewall (WAF) rule blocking common XSS payloads in request parameters handled by the plugin's endpoints can reduce exploitation likelihood, though WAF rules are bypassable and should not substitute for patching. Restricting access to the WordPress admin dashboard via IP allowlisting reduces the blast radius for stored XSS scenarios where the payload targets authenticated admin sessions.