CVE-2023-0600

The WP Visitor Statistics (Real Time Traffic) WordPress plugin versions prior to 6.9 is vulnerable to an unauthenticated SQL Injection attack. The root cause is the failure to escape user input concatenated into an SQL query. Attackers can exploit the visitorId parameter to conduct time-based SQL...

CVE-2022-33965

The CVE-2022-33965 entry corresponds to unauthenticated SQL injection vulnerabilities in the WordPress WP Visitor Statistics plugin (versions up to 5.7). The connected Nuclei template confirms multiple unauthenticated SQLi vectors in WordPress Visitor Statistics (

CVE-2024-24867

CVE-2024-24867 affects the WordPress plugin WP Visitor Statistics (Real Time Traffic). Affected software: WP Visitor Statistics (Real Time Traffic) versions up to 6.9.4. The underlying issue is exposure of sensitive information to unauthorized actors via log files. CVSS data indicate a NETWORK at...

CVE-2022-0410

CVE-2022-0410 affects the WP Visitor Statistics (Real Time Traffic) WordPress plugin prior to 5.6. The refUrlDetails AJAX action uses an unsanitized id parameter in a SQL statement, and this action is accessible to any authenticated user, leading to a SQL injection. Impact stated across connected...

CVE-2021-24750

The WP Visitor Statistics (Real Time Traffic) WordPress plugin versions prior to 4.8 contains a SQL injection vulnerability. The issue arises because the refUrl parameter in the refDetails AJAX action is not properly sanitized or escaped. This flaw is accessible to any authenticated user, allowin...

CVE-2021-25042

The CVE concerns the WordPress plugin WP Visitor Statistics (Real Time Traffic) before version 5.5. The vulnerability stems from missing authorization and CSRF checks in the updateIpAddress AJAX action, allowing any authenticated user or a CSRF attacker to exclude an arbitrary IP address. Due to ...

CVE-2022-4656

The CVE-2022-4656 vulnerability affects the WordPress plugin WP Visitor Statistics (Real Time Traffic) prior to version 6.5. It arises because a shortcode attribute is not properly validated/escaped, enabling Stored XSS when a user with as low as Contributor privileges views the shortcode output....