High severity · published Apr 4, 2026
CVE-2026-2936
Visitor Traffic Real Time Statistics <= 8.4 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS
0.3%
EPSS
No
On KEV
Description
The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_title' parameter in all versions up to, and including, 8.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an admin user accesses the Traffic by Title section.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VT
Visitor Traffic Real Time Statistics · wp-buy
through 8.4 · source: vendor
Affected product
VT
Visitor Traffic Real Time Statistics
wp-buy
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-2936
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-2936
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3466230/visitors-traffic-real-time-statistics
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/bd8e86b0-5e06-44e0-a94c-b05581f46e5a?source=cve
More from Visitor Traffic Real Time Statistics
8.8
CVE-2021-24829
Visitor Traffic Real Time Statistics < 3.9 - Subscriber+ SQL Injection
8.8
CVE-2021-24193
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12, to install any…
8.8
CVE-2019-15832
The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF
8.8
CVE-2019-15831
The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page
7.2
CVE-2026-97341
Visitor Traffic Real Time Statistics <= 8.16 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header