What is the CVSS score of CVE-2026-66429?

CVE-2026-66429 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Visitor Traffic Real Time Statistics Pro are affected by CVE-2026-66429?

The Visitor Traffic Real Time Statistics Pro WordPress plugin (versions ≤11.10) contains a vulnerability enabling attackers to compromise WordPress administrator credentials and sessions without…

How to fix or mitigate CVE-2026-66429?

Within 24 hours: Audit all WordPress installations for Visitor Traffic Real Time Statistics Pro plugin (versions ≤11.10); if found, immediately disable the plugin or implement Web Application Firewall (WAF) rules to block script injection attempts targeting the plugin's traffic data endpoints. Within 7 days: Deploy Content Security Policy (CSP) headers with script-src 'self' to restrict inline script execution in the WordPress admin dashboard and configure logging to detect suspicious administrative activity. Within 30 days: Monitor vendor advisories for a patched version; once released, test and deploy to all affected installations.

Visitor Traffic Real Time Statistics Pro CVE-2026-66429

EUVD-2026-57862 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-13 Patchstack

GHSA-j3x8-6xvw-wgm5

WordPress XSS Codepress Wordpress Plugin Visitor Traffic Real Time Statistics Pro

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Network-delivered unauthenticated XSS with scope change into admin browser; availability not credibly impacted by script injection alone.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:41 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.

AnalysisAI

Unauthenticated stored/reflected Cross-Site Scripting in the Visitor Traffic Real Time Statistics Pro WordPress plugin (versions <= 11.10) allows a remote, unauthenticated attacker to inject malicious scripts into traffic data that is later rendered in the WordPress admin dashboard. Because the CVSS vector shows a changed scope (S:C), the payload executes in the context of a privileged user's browser, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the unauthenticated nature and low attack complexity make this straightforward to weaponize against any site running an unpatched version.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to sanitize user-controlled input before it is embedded in a dynamically generated HTML page. The Visitor Traffic Real Time Statistics Pro plugin by Codepress (CPE: cpe:2.3:a:codepress:visitor_traffic_real_time_statistics_pro:*:*:*:*:*:*:*:*) collects and displays real-time visitor telemetry - likely including HTTP referrers, user-agent strings, IP-derived metadata, or URL query parameters - in a WordPress admin dashboard. Because no authentication is required to submit this traffic data (visitors arrive anonymously), any of these attacker-controlled fields become injection vectors if they are stored without output encoding and later rendered without escaping. The CVSS Scope:Changed metric confirms the exploit crosses trust boundaries from the unauthenticated attacker's HTTP request into the authenticated WordPress admin context.

RemediationAI

Update the Visitor Traffic Real Time Statistics Pro plugin to a version newer than 11.10 via the WordPress admin dashboard (Plugins > Installed Plugins > Update) or the WordPress.org plugin repository. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/visitors-traffic-real-time-statistics-pro/vulnerability/wordpress-visitor-traffic-real-time-statistics-pro-plugin-11-10-cross-site-scripting-xss-vulnerability should be consulted for the exact patched release version, as no specific fix version was confirmed in the available data. If an immediate update is not possible, consider deactivating the plugin until a patch is applied, since disabling it removes the vulnerable attack surface entirely with no side effects beyond losing traffic statistics visibility. As a secondary control, a web application firewall (WAF) rule targeting common XSS patterns in HTTP headers and query parameters can reduce exploitation risk, though WAF bypass is possible and this should not substitute for patching. Restrict access to the WordPress admin dashboard (wp-admin) to trusted IP ranges to limit the blast radius of a successful XSS exploit.