PT-2026-30345 · WordPress · Visitors-Traffic-Real-Time-Statistics

Supakiad S · Published 2026-04-04 · Updated 2026-04-05 · CVE-2026-2936

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Visitor Traffic Real Time Statistics plugin for WordPress versions up to and including 8.4

Description The Visitor Traffic Real Time Statistics plugin for WordPress is susceptible to Stored Cross-Site Scripting through the page title parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into pages. These scripts will execute when an administrator accesses the Traffic by Title section.

Recommendations Update the Visitor Traffic Real Time Statistics plugin to a version later than 8.4.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-2936

Affected Products

Visitors-Traffic-Real-Time-Statistics

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-2936 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/bd8e86b0-5e06-44e0-a94c-b05581f46e5a?source=cve · Note
• https://twitter.com/CVEnew/status/2040481235798200731 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3466230/visitors-traffic-real-time-statistics · Note
• https://reddit.com/r/wpsafety/comments/1scywd0/weekly_cve_roundup_critical_rce_in_everest_forms · Reddit Post
• https://twitter.com/cyberbivash/status/2040418076517191770 · Twitter Post