EUVD-2026-81488
GHSA-p4mf-fj46-h4g7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious XSS payload in plugin parameter
-
DeliveryDeliver crafted link to victim
-
ExploitVictim (admin) loads page, script executes
-
ExecutionSteal session/perform admin actions
-
ImpactSite or account compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an attacker to deliver a crafted request/link whose payload is reflected or stored by Visitor Traffic Real Time Statistics Pro (<=11.21) and then have a victim render it in their browser - the CVSS UI:R confirms victim interaction is mandatory, which is the primary limiting factor. No authentication is required of the attacker (PR:N), so any anonymous internet user can craft the payload, but impact is greatest only when the executing victim is a logged-in administrator (enabling session hijack or admin-action forgery). The plugin must be installed and active on the target WordPress site, and the vulnerable parameter/output path must be reachable in the deployed configuration. |
| Impact | This is an unauthenticated reflected/stored Cross-Site Scripting flaw (CWE-79) in the Visitor Traffic Real Time Statistics Pro WordPress plugin, reported by Patchstack. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L = 7.1) indicates a network-reachable attack requiring no privileges but requiring victim interaction (UI:R), with a scope change (S:C) reflecting the browser-context boundary crossing typical of XSS. Exploitation status is 'no public exploit identified at time of analysis' - there is no EPSS score, no CISA KEV listing, and no POC referenced in the single Patchstack advisory. The A:L (availability) impact in the vendor vector is somewhat generous for a standard XSS and is likely an artifact of Patchstack's automated scoring; browser-script execution rarely degrades server/site availability. The signals are internally consistent for a real-but-moderate web vulnerability: genuinely unauthenticated and network-facing, but gated by the requirement to lure a victim (often an administrator) into clicking a crafted link or viewing injected content. Absent EPSS/KEV/POC data, this is a patch-in-normal-cycle item rather than an emergency; its practical severity hinges on whether the injection reaches an admin session (potential account takeover) versus only anonymous visitors. |
| Exploit ScenarioDerived | An attacker crafts a URL or form input containing a malicious script payload targeting a parameter the plugin echoes without sanitization, then lures a logged-in administrator or site visitor into loading it. When the victim's browser renders the unescaped payload, the script executes in the WordPress site's origin, enabling session/cookie theft, admin-action forgery, or content injection. No public POC or exploit code is currently identified, and successful exploitation requires the victim interaction (UI:R) noted in the CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Unauthenticated cross-site scripting in Visitor Traffic Real Time Statistics Pro (versions up to and including 11.21) lets any anonymous internet user craft a request or link whose payload is reflected or stored by the plugin and then executed in a victim's browser. Because the CVSS vector requires user interaction (UI:R), the attacker cannot trigger the payload without a victim rendering it, and the impact is greatest when that victim is a logged-in WordPress administrator, where script execution can lead to session hijack, credential theft, or forged admin actions. No public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation, though the plugin's unauthenticated attack surface and the very broad install base of WordPress make opportunistic scanning plausible.
RemediationAI
No vendor-released patch version is identified in the available intelligence, so the immediate priority is to confirm the current fix status with the vendor and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/visitors-traffic-real-time-statistics-pro/vulnerability/wordpress-visitor-traffic-real-time-statistics-pro-plugin-11-21-cross-site-scripting-xss-vulnerability?_s_id=cve) and upgrade to the first release published after 11.21 if one exists. If no fixed build is available, deactivate and remove the plugin from all internet-facing WordPress installations; the trade-off is loss of the visitor statistics dashboard and any shortcodes or widgets the plugin renders, so capture historical data first. Where removal is not business-acceptable, restrict the plugin's output paths: deploy a WAF rule set that blocks angle brackets and script/event-handler patterns in query strings and POST bodies targeting the plugin's endpoints, and front the site with a reverse proxy that enforces a strict Content-Security-Policy (script-src 'self' with nonces), accepting that a strict CSP may break legitimate admin UI scripts. Additionally, never browse the site with an administrator session while untrusted links are present, apply WordPress cookie hardening (HttpOnly, SameSite=Strict on auth cookies) and enforce re-authentication before sensitive admin operations; these reduce session-hijack impact but do not eliminate the underlying output-encoding defect. Monitor Patchstack and EUVD-2026-81488 for a patched version notification and re-scan after each update.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a classic CWE-79 improper neutralization of input during web page generation flaw in a WordPress plugin. Visitor Traffic Real Time Statistics Pro collects and renders visitor/traffic telemetry through its own pages and dashboard widgets; the affected code paths pass attacker-controllable input (typically a request parameter or a stored traffic-record field) into HTML output without adequate escaping or output encoding. The CPE cpe:2.3:a:codepress_it_solutions_llc:visitor_traffic_real_time_statistics_pro:*:*:*:*:*:*:*:* uses a wildcard version, indicating the vendor's entire published version history is treated as affected at the time the CPE was generated, with the EUVD record enumerating the concrete boundary as ≤11.21. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N describes a network-reachable, low-complexity bug requiring no attacker authentication (PR:N) but mandatory victim interaction (UI:R); the scope change (S:C) reflects that the injected script executes in the context of the WordPress site/admin origin rather than the vulnerable component itself, which is why confidentiality and integrity are rated Low each while availability is None. The discrepancy between the supplied base vector (A:L) and the assessed vector (A:N) is resolved in favor of the assessment: script execution alone does not degrade availability of the plugin or host. Exploitation requires the plugin to be installed and active and the vulnerable parameter/output path to be reachable in the deployed configuration.
Know when Visitor Traffic Real Time Statistics Pro gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated network-reachable XSS needing victim interaction (UI:R) with a browser-context scope change (S:C) and low confidentiality/integrity impact; availability is unaffected, so A:N rather than the vendor's A:L.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.21 versions.
Executive ViewAI
A high-severity cross-site scripting flaw affects the WordPress plugin Visitor Traffic Real Time Statistics Pro (versions up to and including 11.21), which is widely deployed across the organization's WordPress estate. Because exploitation requires an anonymous attacker to lure a logged-in administrator into rendering a malicious link or page, a successful attack could hand over administrative session control, enabling credential theft, unauthorized content or configuration changes, and potential lateral movement into hosted infrastructure. Leadership should care because the affected plugin is commonly installed on public-facing sites, and the absence of a vendor patch means exposure cannot be closed by routine update cycles alone.
No vendor-released patch identified at time of analysis. Interim mitigations include deactivating or removing the plugin where feasible, restricting wp-admin and login access by IP allowlist, enforcing multi-factor authentication for all administrator accounts, deploying WAF rules to block reflected or stored script payloads, and monitoring admin sessions and activity logs for anomalous behavior.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
SQL injection in the WordPress plugin Visitor Traffic Real Time Statistics Pro (all versions up to and including 11.17)
SQL injection in the WordPress plugin Visitor Traffic Real Time Statistics Pro (versions 11.10 and earlier) enables any
Unauthenticated stored cross-site scripting in the Visitors Traffic Real Time Statistics Pro WordPress plugin (all versi
Unauthenticated stored/reflected Cross-Site Scripting in the Visitor Traffic Real Time Statistics Pro WordPress plugin (
Reflected cross-site scripting in the Visitor Traffic Real Time Statistics Pro WordPress plugin (versions 11.9.1 and ear
Exploit-DB