What is the CVSS score of CVE-2026-57370?

CVE-2026-57370 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Visitor Traffic Real Time Statistics Pro are affected by CVE-2026-57370?

The Visitor Traffic Real Time Statistics Pro WordPress plugin (versions 11.9.1 and earlier) contains a reflected XSS vulnerability affecting any WordPress installation using this plugin.

How to fix or mitigate CVE-2026-57370?

Within 24 hours, inventory all WordPress installations running Visitor Traffic Real Time Statistics Pro and document version numbers across environments. Within 7 days, since no vendor patch is currently available, either deactivate the plugin or implement interim controls including Web Application Firewall rules to block XSS payloads and strict Content Security Policy headers to restrict script execution. Within 30 days, monitor Patchstack and the plugin vendor's security advisories for patch availability; upon release, prioritize update to the patched version immediately and evaluate alternative traffic analytics plugins to reduce future risk.

Visitor Traffic Real Time Statistics Pro CVE-2026-57370

EUVD-2026-48163 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-8mj6-w486-3236

WordPress XSS Wordpress Plugin Visitor Traffic Real Time Statistics Pro

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Unauthenticated network reflected XSS requiring a victim click (UI:R) with scope change into the browser (S:C); low confidentiality/integrity impact but no genuine availability impact, so A:N.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:18 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.9.1 versions.

AnalysisAI

Reflected cross-site scripting in the Visitor Traffic Real Time Statistics Pro WordPress plugin (versions 11.9.1 and earlier) allows an unauthenticated attacker to inject arbitrary JavaScript that executes in a victim's browser when a crafted link is opened. Disclosed by Patchstack, the flaw carries a CVSS 7.1 due to a scope change (S:C) into the browser context; there is no public exploit identified at time of analysis and it is not on the CISA KEV list. Impact is limited by the requirement for victim interaction (clicking a malicious link).

Technical ContextAI

The vulnerability is a CWE-79 (Improper Neutralization of Input During Web Page Generation) reflected XSS in a commercial WordPress plugin published by CodePress IT Solutions LLC that provides real-time visitor and traffic analytics dashboards. Per the CPE (cpe:2.3:a:codepress_it_solutions_llc:visitor_traffic_real_time_statistics_pro:*), the flaw resides in server-side handling of user-supplied request parameters that are echoed back into an HTML response without proper output encoding or input sanitization. Because it is 'unauthenticated' and reflected, the malicious payload is not stored but must be delivered per-request, typically via a URL parameter that the plugin renders unescaped into the page.

RemediationAI

No vendor-released patch version is identified in the available data, so administrators should monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/visitors-traffic-real-time-statistics-pro/vulnerability/wordpress-visitor-traffic-real-time-statistics-pro-plugin-11-9-1-reflected-cross-site-scripting-xss-vulnerability) and the plugin vendor for a release newer than 11.9.1 and upgrade as soon as one is published. As interim compensating controls, deploy a Web Application Firewall (e.g., Patchstack or a WordPress security plugin) with rules that block reflected XSS payloads targeting the plugin's request parameters, restrict or disable public access to the plugin's affected endpoint if the analytics feature is not needed for anonymous users, and consider deactivating the plugin until a fix is available if it is not business-critical; the trade-off of deactivation is loss of real-time traffic reporting, while WAF filtering may produce false positives on legitimate query strings.