CVE-2026-109230

Name of the Vulnerable Software and Affected Versions WP Visitor Statistics (Real Time Traffic) versions prior to 8.7.2

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs via the browser parameter when sending an unauthenticated HTTP request to the public visitor tracking endpoint 'wmcAction=wmcTrack'. The injected script executes in the browser of an authenticated administrator when the bundled jqPlot PieRenderer inserts the HTML-decoded series label directly as HTML.

Recommendations Update WP Visitor Statistics (Real Time Traffic) to version 8.7.2 or later. Avoid using the browser parameter in the 'wmcAction=wmcTrack' endpoint until the update is applied.