Visitor Traffic Statistics Pro CVE-2026-93367

Exploitation requires that the vulnerable plugin be installed and active, and that the ahcpro_track_visitor AJAX endpoint remain registered for unauthenticated (wp_ajax_nopriv_) callers - which is the default per the description, so no special attacker-side configuration or authentication is needed to plant the payload. The payload only executes under one concrete condition: an administrator must subsequently open the plugin's dashboard and view the 'Traffic by Title' DataTable, since that is where the stored til_page_title value is rendered as innerHTML without escaping. This admin-view dependency is the main limiting factor - the attack is passive and deferred, not instantaneous, and does not fire against anonymous visitors or non-admin users.

This is a genuine, exploitable vulnerability but sits in the medium-priority tier rather than the top of the stack. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 High) describes network-reachable, low-complexity, unauthenticated injection with a scope change - consistent with the description: the ahcpro_track_visitor AJAX action is exposed to logged-out callers (wp_ajax_nopriv_) and stores page_title raw, then renders it as innerHTML in the admin 'Traffic by Title' DataTable. The signals are internally consistent (the PR:N and S:C claims are directly supported by the described nopriv registration and cross-context execution in an admin session). The limiting factor the raw CVSS score understates is the second-order trigger: code only executes when an authenticated administrator opens the plugin dashboard, so impact is deferred and victim-dependent rather than instantaneous. On missing signals: no EPSS score, no KEV listing, and no POC indicator were provided, so there is no evidence of active or at-scale exploitation - exploitation status is 'no public exploit identified at time of analysis.' Net: a real issue worth patching promptly on affected sites, but absent KEV/EPSS/POC data it is a routine WordPress stored-XSS rather than an emergency; the primary risk is full admin-session compromise (cookie theft, rogue admin creation, plugin/site takeover) via the scope change.

An unauthenticated attacker sends a crafted POST to admin-ajax.php invoking action=ahcpro_track_visitor with a malicious page_title containing a script payload, which is stored unsanitized in the ahc_title_traffic.til_page_title column. Later, when a site administrator opens the plugin's 'Traffic by Title' dashboard, the payload renders as innerHTML and executes JavaScript in the admin's authenticated session, enabling session hijack or creation of a new administrator account. No public exploit code was identified in the provided data, but the attack is low-complexity (AV:N/AC:L) and requires no attacker authentication.