What is the CVSS score of CVE-2026-4303?

CVE-2026-4303 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-4303

EUVD-2026-20437 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-08 Wordfence

GHSA-4cxh-x4x5-vrrg

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 10:00 euvd

EUVD-2026-20437

Analysis Generated

Apr 08, 2026 - 10:00 vuln.today

CVE Published

Apr 08, 2026 - 09:25 nvd

MEDIUM 6.4

DescriptionCVE.org

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wsm_showDayStatsGraph' shortcode in all versions up to, and including, 8.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in WP Visitor Statistics plugin versions up to 8.4 allows authenticated contributors and higher-privileged users to inject arbitrary JavaScript through the 'wsm_showDayStatsGraph' shortcode due to insufficient input sanitization and output escaping. Injected scripts execute in the context of any user accessing the affected page, potentially compromising site visitors and enabling account takeover or malware distribution. No public exploit code or active exploitation has been confirmed at this time.

Technical ContextAI

The vulnerability exists in the WordPress plugin WP Visitor Statistics (wp-stats-manager) and stems from improper handling of user-supplied attributes in the 'wsm_showDayStatsGraph' shortcode handler. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic Stored XSS weakness. The affected code in wsm_statistics.php (around line 2272 and 2392) and wsm_init.php (line 208) processes shortcode attributes without adequate sanitization before rendering them in HTML context. Because the malicious payload is stored in the WordPress database as part of page or post content, it persists and executes each time the page is viewed, affecting all site visitors regardless of their privileges.

RemediationAI

Update the WP Visitor Statistics plugin to the patched version released after 8.4 via the WordPress plugin dashboard or by directly upgrading from plugins.trac.wordpress.org. The upstream fix is available in the wp-stats-manager repository trunk (see changeset reference in provided data). Site administrators should immediately audit all pages and posts for suspicious shortcode attributes, particularly those using 'wsm_showDayStatsGraph', and review contributor-level user accounts to ensure legitimate access. Until patching is complete, restrict the use of the 'wsm_showDayStatsGraph' shortcode or disable the plugin entirely. For detailed remediation guidance, refer to the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/3b6916d3-3944-43a2-8d5e-424f86c753ad?source=cve.