EUVD-2026-18995
GHSA-pxhv-8xjp-pj79
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
Lifecycle Timeline
4DescriptionCVE.org
The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_title' parameter in all versions up to, and including, 8.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an admin user accesses the Traffic by Title section.
AnalysisAI
Stored Cross-Site Scripting in Visitor Traffic Real Time Statistics WordPress plugin (≤8.4) allows unauthenticated remote attackers to inject malicious JavaScript via the 'page_title' parameter that executes when administrators view the Traffic by Title section. No public exploit identified at time of analysis, though CVSS 7.2 (High) severity reflects the unauthenticated attack vector and cross-site scripting scope. Upstream fix available (PR/commit); released patched version not independently confirmed based on provided Trac changeset reference.
Technical ContextAI
This vulnerability affects the wp-buy Visitor Traffic Real Time Statistics plugin for WordPress (CPE: cpe:2.3:a:wp-buy:visitor_traffic_real_time_statistics). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored XSS condition. The plugin fails to properly sanitize user-supplied data in the 'page_title' parameter before storing it in the database and subsequently fails to escape this data when rendering it in the administrative Traffic by Title dashboard. Unlike reflected XSS, stored XSS persists the malicious payload in the application's data layer, making it particularly dangerous as the attack triggers automatically whenever the vulnerable page is accessed. WordPress plugins commonly suffer from this vulnerability class when developers fail to apply WordPress's built-in sanitization functions (like sanitize_text_field) on input and escaping functions (like esc_html, esc_attr) on output.
RemediationAI
Site administrators should immediately update to the patched version of Visitor Traffic Real Time Statistics. A code-level fix has been committed to the WordPress plugin repository as documented in changeset 3466230 at https://plugins.trac.wordpress.org/changeset/3466230/visitors-traffic-real-time-statistics, which implements proper input sanitization and output escaping for the page_title parameter. Administrators should verify the update through the WordPress dashboard (Plugins > Installed Plugins > Update Available) and apply the latest version. As an interim workaround until patching, administrators can restrict access to the Traffic by Title dashboard section to only trusted administrators, though this does not eliminate the vulnerability. Organizations should also review web application firewall (WAF) rules to detect and block XSS injection attempts targeting this parameter. For comprehensive protection, implement Content Security Policy (CSP) headers to mitigate XSS execution even if payloads are injected. Site administrators should audit existing traffic data for potential malicious payloads by reviewing page_title entries in the plugin's database tables for JavaScript code patterns.
The Visitor Traffic Real Time Statistics WordPress plugin before 3.9 does not validate and escape user input passed to t
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time
The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF. Rated high severity (CVSS 8.8), thi
The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page. Rated high sev
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today