Stored Cross-Site Scripting in Visitor Traffic Real Time Statistics Plugin for WordPress
CVE-2026-2936

7.2HIGH

Key Information:

Vendor

WordPress
Status
Visitor Traffic Real Time Statistics
Vendor
CVE Published:
4 April 2026

What is CVE-2026-2936?

The Visitor Traffic Real Time Statistics plugin for WordPress is susceptible to stored cross-site scripting due to inadequate input sanitization and output escaping, specifically within the 'page_title' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts. These scripts are executed when an admin user accesses the Traffic by Title section, potentially compromising the security of the site and the data of its users.

Affected Version(s)

Visitor Traffic Real Time Statistics 0 <= 8.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3466230/visi...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Supakiad S.
.