CVE-2026-117571
Received Received - Intake

WP Visitor Statistics Plugin Authenticated Stored Cross-Site Scripting

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: WPScan

Description
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a logged-in administrator views the statistics pages.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-117571
EUVD
EUVD-2026-113726

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown WP Visitor Statistics (Real Time Traffic) 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated stored cross-site scripting (XSS) vulnerability in the WP Visitor Statistics (Real Time Traffic) WordPress plugin versions before 8.8. Attackers can inject malicious scripts via tracker device parameters in public visitor requests. The plugin fails to sanitize or escape this data before storing and displaying it in the admin statistics dashboard. When an admin views the affected pages, the injected scripts execute.

Detection Guidance

To detect this vulnerability, check if your WordPress site uses the WP Visitor Statistics (Real Time Traffic) plugin version prior to 8.8. Inspect the plugin files for unsanitized tracking data inputs in the administrative dashboard. Look for suspicious scripts in the statistics pages that may indicate XSS injection.

Impact Analysis

Unauthenticated attackers could inject malicious scripts into your WordPress site. If you are an administrator viewing the statistics dashboard, these scripts could execute, potentially leading to session hijacking, unauthorized actions, or further compromise of your site or user data.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR (data protection) or HIPAA (health data privacy) requirements. Compromised admin sessions or data exposure could result in non-compliance, legal penalties, or reputational damage.

Mitigation Strategies

Immediately update the WP Visitor Statistics (Real Time Traffic) plugin to version 8.8 or later. If updating is not possible, consider disabling or removing the plugin until a patched version is installed. Review the administrative statistics dashboard for any signs of malicious scripts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-117571. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart