Executive brief
The Visitor Traffic Real Time Statistics plugin for WordPress, which tracks website visitor data, contains a security flaw that allows unauthorized individuals to inject malicious scripts into the site's database. These scripts are triggered when a site administrator views the plugin's traffic reports. This could lead to unauthorized administrative actions or the theft of sensitive session information from site managers.
Technical details
The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'page_title' parameter. An unauthenticated remote attacker can exploit this by sending a crafted request that includes malicious JavaScript in the page title field, which is then stored in the database. The script executes in the context of an administrator's browser session when they navigate to the 'Traffic by Title' section of the plugin's dashboard. This vulnerability is present in all versions up to and including 8.4; a fix was introduced in version 8.5 via a changeset on the WordPress plugin repository.
Affected products
- wp-buy Visitor Traffic Real Time Statistics <= 8.4
Timeline
- 2026-04-04: advisory: Initial disclosure by Wordfence and NVD
- 2026-04-04: patched: Patch identified in plugin changeset 3466230