What is the CVSS score of CVE-2026-2936?

CVE-2026-2936 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-2936?

The Visitor Traffic Real Time Statistics WordPress plugin (version 8.4 and earlier) contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious code…

How to fix or mitigate CVE-2026-2936?

Within 24 hours: Identify all WordPress installations using Visitor Traffic Real Time Statistics plugin ≤8.4 and document current version. Within 7 days: Contact the plugin vendor to confirm patched version availability and test in a staging environment; consider temporarily disabling the plugin if patched version is unavailable. Within 30 days: Deploy confirmed patched version to all production WordPress instances and validate functionality; implement input validation controls on traffic data fields if plugin remains in use.

WordPress CVE-2026-2936

EUVD-2026-18995 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-04-04 Wordfence

GHSA-pxhv-8xjp-pj79

WordPress XSS

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:22 vuln.today

cvss_changed

EUVD ID Assigned

Apr 04, 2026 - 11:30 euvd

EUVD-2026-18995

Analysis Generated

Apr 04, 2026 - 11:30 vuln.today

CVE Published

Apr 04, 2026 - 11:16 nvd

HIGH 7.2

DescriptionCVE.org

The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_title' parameter in all versions up to, and including, 8.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an admin user accesses the Traffic by Title section.

AnalysisAI

Stored Cross-Site Scripting in Visitor Traffic Real Time Statistics WordPress plugin (≤8.4) allows unauthenticated remote attackers to inject malicious JavaScript via the 'page_title' parameter that executes when administrators view the Traffic by Title section. No public exploit identified at time of analysis, though CVSS 7.2 (High) severity reflects the unauthenticated attack vector and cross-site scripting scope. Upstream fix available (PR/commit); released patched version not independently confirmed based on provided Trac changeset reference.

Technical ContextAI

This vulnerability affects the wp-buy Visitor Traffic Real Time Statistics plugin for WordPress (CPE: cpe:2.3:a:wp-buy:visitor_traffic_real_time_statistics). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored XSS condition. The plugin fails to properly sanitize user-supplied data in the 'page_title' parameter before storing it in the database and subsequently fails to escape this data when rendering it in the administrative Traffic by Title dashboard. Unlike reflected XSS, stored XSS persists the malicious payload in the application's data layer, making it particularly dangerous as the attack triggers automatically whenever the vulnerable page is accessed. WordPress plugins commonly suffer from this vulnerability class when developers fail to apply WordPress's built-in sanitization functions (like sanitize_text_field) on input and escaping functions (like esc_html, esc_attr) on output.

RemediationAI

Site administrators should immediately update to the patched version of Visitor Traffic Real Time Statistics. A code-level fix has been committed to the WordPress plugin repository as documented in changeset 3466230 at https://plugins.trac.wordpress.org/changeset/3466230/visitors-traffic-real-time-statistics, which implements proper input sanitization and output escaping for the page_title parameter. Administrators should verify the update through the WordPress dashboard (Plugins > Installed Plugins > Update Available) and apply the latest version. As an interim workaround until patching, administrators can restrict access to the Traffic by Title dashboard section to only trusted administrators, though this does not eliminate the vulnerability. Organizations should also review web application firewall (WAF) rules to detect and block XSS injection attempts targeting this parameter. For comprehensive protection, implement Content Security Policy (CSP) headers to mitigate XSS execution even if payloads are injected. Site administrators should audit existing traffic data for potential malicious payloads by reviewing page_title entries in the plugin's database tables for JavaScript code patterns.