← WordPress Vulnerabilities
WordPress security by component

wp-visitor-statistics-real-time-traffic

wp-visitor-statistics-real-time-traffic is a WordPress plugin with 2 published CVE records in this archive. The latest tracked vulnerability was published Oct 30, 2026; an upstream CVSS base score is still pending.

Plugin slug: wp-visitor-statistics-real-time-traffic

CVE-2026-117572: WP Visitor Statistics (Real Time Traffic): SQL injection

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement, allowing high-privilege users such as administrators to perform SQL injection attacks. The export does not disclose the attacker authentication requirement. The structured affected range is < 8.8.

PublishedOct 30, 2026
Known safe version8.8
Published vulnerabilities for wp-visitor-statistics-real-time-traffic
Safe version
Oct 30, 2026 CVE-2026-117572
WP Visitor Statistics (Real Time Traffic): SQL injection
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement, allowing high-privilege users such as administrators to perform SQL injection attacks. The export does not disclose the attacker authentication requirement. The structured affected range is < 8.8.
8.8
CVEPending
Oct 30, 2026 CVE-2026-117571
WP Visitor Statistics (Real Time Traffic): Stored cross-site scripting
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a logged-in administrator views the statistics pages. The structured affected range is < 8.8.
8.8
CVEPending