CVE-2026-93367

Name of the Vulnerable Software and Affected Versions Visitors Traffic Real Time Statistics Pro versions prior to 11.23

Description Unauthenticated stored Cross-Site Scripting (XSS) occurs when the plugin fails to sanitize the page title parameter within the ahcpro track visitor AJAX action. This action is accessible to logged-out users via wp ajax nopriv ahcpro track visitor, allowing raw input to be stored in the database. When an administrator accesses the plugin dashboard, the 'Traffic by Title' DataTable renders this stored value as innerHTML without output escaping, which enables the execution of arbitrary JavaScript within the administrator's session.

Recommendations Update to a version newer than 11.22. As a temporary workaround, restrict access to the ahcpro track visitor AJAX action to prevent unauthenticated users from submitting data via the page title parameter.