PT-2026-31289 · WordPress · Wp Visitor Statistics

Published

2026-04-08

·

Updated

2026-04-12

·

CVE-2026-4303

CVSS v3.1

6.4

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions WP Visitor Statistics (Real Time Traffic) versions up to and including 8.4
Description The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'wsm showDayStatsGraph' shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page.
Recommendations Update WP Visitor Statistics (Real Time Traffic) to a version later than 8.4.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-4303

Affected Products

Wp Visitor Statistics