Stored Cross-Site Scripting Vulnerability in WP Visitor Statistics Plugin for WordPress

CVE-2026-109230

What is CVE-2026-109230?

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the 'browser' parameter. This lack of proper input sanitization and output escaping can lead to arbitrary web scripts executing in users' browsers when they access compromised pages. The vulnerability is present in all versions up to and including 8.7.1, and attackers exploit it via unauthenticated HTTP requests to the visitor tracking endpoint, where malicious payloads can be stored and later triggered, exposing site administrators to potential exploits.

References