Skip to content
Sign in
7.2 High

CVE-2026-2936 The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…

Description

The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_title' parameter in all versions up to, and including, 8.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an admin user accesses the Traffic by Title section.

Affected products and versions

Product Affected versions Fixed in
Visitor Traffic Real Time Statistics 8.4 earliest → 8.4 No fix stated

Other CVEs of Visitor Traffic Real Time Statistics

The 3 CVEs of Visitor Traffic Real Time Statistics →
CVE-2026-97341 The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via… 7.2 High CVE-2021-24193 Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real… Not rated
Track this CVE