CVE-2026-97341

Name of the Vulnerable Software and Affected Versions Visitor Traffic Real Time Statistics plugin for WordPress versions prior to 8.17

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored DOM-Based Cross-Site Scripting. An attacker can inject arbitrary web scripts by sending a forged X-Real-IP HTTP header to the wp ajax nopriv ahcfree track visitor endpoint. The payload is stored verbatim in the database and executes whenever a user accesses the affected page.

Recommendations Update the Visitor Traffic Real Time Statistics plugin for WordPress to version 8.17 or later.