WordPress WP Visitor Statistics (Real Time Traffic) plugin < 8.8 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by an7ln in WordPress Plugin WP Visitor Statistics Real Time Traffic versions 8.8...

CVE-2026-117571

The WP Visitor Statistics Real Time Traffic WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboard, allowing unauthenticated attackers to inject arbitrary web script...

CVE-2026-117572

The WP Visitor Statistics Real Time Traffic WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement, allowing high-privilege users such as administrators to perform SQL injection attacks...

EUVD-2026-113727

The WP Visitor Statistics Real Time Traffic WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement, allowing high-privilege users such as administrators to perform SQL injection attacks...

CVE-2026-117571 WP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker Device Parameters

The WP Visitor Statistics Real Time Traffic WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboard, allowing unauthenticated attackers to inject arbitrary web script...

CVE-2026-117572 WP Visitor Statistics (Real Time Traffic) < 8.8 - Admin+ SQLi via 'order' Parameter

The WP Visitor Statistics Real Time Traffic WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement, allowing high-privilege users such as administrators to perform SQL injection attacks...

CVE-2026-117571 WP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker Device Parameters

The WP Visitor Statistics Real Time Traffic WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboard, allowing unauthenticated attackers to inject arbitrary web script...

CVE-2026-117572 WP Visitor Statistics (Real Time Traffic) < 8.8 - Admin+ SQLi via 'order' Parameter

The WP Visitor Statistics Real Time Traffic WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement, allowing high-privilege users such as administrators to perform SQL injection attacks...

CVE-2026-117572

The WP Visitor Statistics (Real Time Traffic) WordPress plugin in versions before 8.8 is vulnerable to SQL injection . The root cause is the failure to properly sanitize and escape the 'order' parameter before utilizing it in a SQL statement. This flaw allows users with high privileges, such as a...

CVE-2026-117571

The WP Visitor Statistics (Real Time Traffic) WordPress plugin, in versions before 8.8 , is vulnerable to an unauthenticated stored XSS vulnerability. The issue occurs because the plugin fails to properly sanitize and escape tracking data received from public visitor requests before storing it in...

EUVD-2026-113726

The WP Visitor Statistics Real Time Traffic WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboard, allowing unauthenticated attackers to inject arbitrary web script...

WordPress WP Visitor Statistics (Real Time Traffic) plugin < 8.8 - Admin+ SQLi vulnerability

Admin+ SQLi vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin WP Visitor Statistics Real Time Traffic versions 8.8...

CVE-2026-116609

The WP Visitor Statistics Real Time Traffic plugin for WordPress is vulnerable to SQL Injection via the 'from' and sibling 'to'/'first'/'second' shortcode attribute of the wsmshowTrafficStatsList shortcode in versions up to, and including, 8.8 This is due to insufficient escaping on the...

EUVD-2026-111733

The WP Visitor Statistics Real Time Traffic plugin for WordPress is vulnerable to SQL Injection via the 'from' and sibling 'to'/'first'/'second' shortcode attribute of the wsmshowTrafficStatsList shortcode in versions up to, and including, 8.8 This is due to insufficient escaping on the...

CVE-2026-116609

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to SQL Injection in versions up to and including 8.8 . The flaw exists in the [wsm_showTrafficStatsList] shortcode because the from (as well as to, first, and second) attributes are not properly escaped. Specifically...

CVE-2026-116609 WP Visitor Statistics (Real Time Traffic) <= 8.8 - Authenticated (Contributor+) SQL Injection via 'from' Shortcode Attribute

The WP Visitor Statistics Real Time Traffic plugin for WordPress is vulnerable to SQL Injection via the 'from' and sibling 'to'/'first'/'second' shortcode attribute of the wsmshowTrafficStatsList shortcode in versions up to, and including, 8.8 This is due to insufficient escaping on the...

PT-2026-127880

The WP Visitor Statistics Real Time Traffic plugin for WordPress is vulnerable to SQL Injection via the 'from' and sibling 'to'/'first'/'second' shortcode attribute of the wsm showTrafficStatsList shortcode in versions up to, and including, 8.8 This is due to insufficient escaping on the...

WordPress WP Visitor Statistics (Real Time Traffic) plugin <= 8.8 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Visitor Statistics Real Time Traffic versions = 8.8...

CVE-2026-96267

The WP Visitor Statistics Real Time Traffic plugin for WordPress is vulnerable to generic SQL Injection via the 'fullRef' parameter in all versions up to, and including, 8.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

CVE-2026-96267 WP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthenticated SQL Injection via 'fullRef' Parameter

The WP Visitor Statistics Real Time Traffic plugin for WordPress is vulnerable to generic SQL Injection via the 'fullRef' parameter in all versions up to, and including, 8.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...