Codepress
Monthly
SQL injection in the WordPress plugin Visitor Traffic Real Time Statistics Pro (versions 11.10 and earlier) enables any subscriber-level authenticated user to extract sensitive data from the site's underlying database. The CVSS 3.1 score of 8.5 reflects a network-accessible, low-complexity attack with a changed scope, meaning the injection reaches beyond the plugin's own tables into the shared WordPress database - including user credentials and personally identifiable information. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed by Patchstack.
Unauthenticated stored/reflected Cross-Site Scripting in the Visitor Traffic Real Time Statistics Pro WordPress plugin (versions <= 11.10) allows a remote, unauthenticated attacker to inject malicious scripts into traffic data that is later rendered in the WordPress admin dashboard. Because the CVSS vector shows a changed scope (S:C), the payload executes in the context of a privileged user's browser, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the unauthenticated nature and low attack complexity make this straightforward to weaponize against any site running an unpatched version.
Authenticated remote code execution in the Admin Columns WordPress plugin (versions through 7.0.18) allows Contributor-level users to inject serialized PHP objects via post meta and trigger a bundled POP gadget chain through the Laravel SerializableClosure component. Reported by Wordfence with CVSS 8.8, no public exploit identified at time of analysis, though the low privilege barrier and bundled gadget chain make weaponization straightforward for any researcher with plugin access.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Osamaesh WP Visitor Statistics (Real Time Traffic).9.4. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.9 does not escape user input which is concatenated to an SQL query, allowing unauthenticated visitors to conduct SQL Injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities in Osamaesh WP Visitor Statistics plugin <= 5.7 at WordPress. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.6 does not sanitise and escape the id parameter before using it in a SQL statement via the refUrlDetails AJAX action, available. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails AJAX action, available to any authenticated user, which. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
SQL injection in the WordPress plugin Visitor Traffic Real Time Statistics Pro (versions 11.10 and earlier) enables any subscriber-level authenticated user to extract sensitive data from the site's underlying database. The CVSS 3.1 score of 8.5 reflects a network-accessible, low-complexity attack with a changed scope, meaning the injection reaches beyond the plugin's own tables into the shared WordPress database - including user credentials and personally identifiable information. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed by Patchstack.
Unauthenticated stored/reflected Cross-Site Scripting in the Visitor Traffic Real Time Statistics Pro WordPress plugin (versions <= 11.10) allows a remote, unauthenticated attacker to inject malicious scripts into traffic data that is later rendered in the WordPress admin dashboard. Because the CVSS vector shows a changed scope (S:C), the payload executes in the context of a privileged user's browser, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the unauthenticated nature and low attack complexity make this straightforward to weaponize against any site running an unpatched version.
Authenticated remote code execution in the Admin Columns WordPress plugin (versions through 7.0.18) allows Contributor-level users to inject serialized PHP objects via post meta and trigger a bundled POP gadget chain through the Laravel SerializableClosure component. Reported by Wordfence with CVSS 8.8, no public exploit identified at time of analysis, though the low privilege barrier and bundled gadget chain make weaponization straightforward for any researcher with plugin access.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Osamaesh WP Visitor Statistics (Real Time Traffic).9.4. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.9 does not escape user input which is concatenated to an SQL query, allowing unauthenticated visitors to conduct SQL Injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities in Osamaesh WP Visitor Statistics plugin <= 5.7 at WordPress. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.6 does not sanitise and escape the id parameter before using it in a SQL statement via the refUrlDetails AJAX action, available. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails AJAX action, available to any authenticated user, which. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.