Visitors Traffic Real Time Statistics
Monthly
Unauthenticated cross-site scripting in the WordPress plugin Visitors Traffic Real Time Statistics (versions 8.11 and below, by vendor wp-buy) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages served to authenticated WordPress users. The CVSS vector (S:C) confirms the scope crosses from the plugin's execution context into the victim's browser session, enabling session hijacking, credential theft, or admin takeover. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the unauthenticated, low-complexity attack surface warrants prompt patching given the wide WordPress ecosystem.
Unauthenticated cross-site scripting in the WordPress plugin Visitors Traffic Real Time Statistics (versions 8.11 and below, by vendor wp-buy) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages served to authenticated WordPress users. The CVSS vector (S:C) confirms the scope crosses from the plugin's execution context into the victim's browser session, enabling session hijacking, credential theft, or admin takeover. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the unauthenticated, low-complexity attack surface warrants prompt patching given the wide WordPress ecosystem.