CVE-2025-49400

WordPress WP Visitor Statistics (Real Time Traffic) Plugin <= 8.2 - Cross Site Scripting (XSS) Vulnerability

Published Aug 20, 2025 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) allows Stored XSS. This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through 8.2.

Analysis

Technical impact

The vulnerability is an improper neutralization of input during web page generation, allowing attackers to store malicious scripts in the WordPress WP Visitor Statistics (Real Time Traffic) plugin. Stored XSS can execute arbitrary JavaScript in the browsers of site visitors, enabling session hijacking, credential theft, defacement, or further exploitation of the target application. This weakness is identified as CWE-79, representing a severe impact on the confidentiality, integrity, and availability of user data and website functionality.

Affected Systems

The affected product is the WP Visitor Statistics (Real Time Traffic) WordPress plugin by osama.esh, versions up to and including 8.2. Users who have installed any of these versions on WordPress sites are susceptible; newer releases (8.3 or later) contain the fix.

Risk and Exploitability

The CVSS base score of 9.8 classifies this as critical, yet the EPSS score of less than 1% indicates a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, so no known mass exploitation reports exist. Attackers would likely leverage the plugin’s data entry forms to inject malicious payloads, which are then served to all site visitors, making it a low effort, high impact attack scenario.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

osama.esh

WP Visitor Statistics (Real Time Traffic)

unaffected

Version	Status	Constraints
`n/a`	affected	≤ 8.2

No data.

No data available yet.

Remediation

Vendor Solution

Update the WordPress WP Visitor Statistics (Real Time Traffic) plugin to the latest available version (at least 8.3).

OpenCVE Recommended Actions

Update the WP Visitor Statistics (Real Time Traffic) plugin to version 8.3 or later.
If an upgrade is not immediately possible, remove the plugin from the site to prevent any stored data from being served.
Enable a content security policy that blocks inline scripts and restricts script sources to trusted origins.

Generated by OpenCVE AI on April 30, 2026 at 08:14 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-28300	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) allows Stored XSS. This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through 8.2.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.529% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/wordpress/plugin/wp-stats-manager/vulnerability/wordpress-wp-visitor-statistics-real-time-traffic-plugin-8-2-cross-site-scripting-xss-vulnerability?_s_id=cve

History

Apr 28, 2026 7:45 PM Weaknesses updated. References updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-502
References	https://patchstack.com/database/Wordpress/Plugin/pressapps-knowledge-base/vulnerability/wordpress-pressapps-knowledge-base-contextual-sidebar-addon-plugin-4-2-1-php-object-injection-vulnerability?_s_id=cve

Apr 28, 2026 6:30 PM Description updated. Title updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description	Deserialization of Untrusted Data vulnerability in osama.esh PressApps Knowledge Base Contextual Sidebar Addon pressapps-knowledge-base allows Object Injection.This issue affects PressApps Knowledge Base Contextual Sidebar Addon: from n/a through <= 4.2.1.	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) allows Stored XSS. This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through 8.2.
Title	WordPress PressApps Knowledge Base Contextual Sidebar Addon Plugin <= 4.2.1 - PHP Object Injection Vulnerability	WordPress WP Visitor Statistics (Real Time Traffic) Plugin <= 8.2 - Cross Site Scripting (XSS) Vulnerability
Weaknesses		CWE-79
References		https://patchstack.com/database/wordpress/plugin/wp-stats-manager/vulnerability/wordpress-wp-visitor-statistics-real-time-traffic-plugin-8-2-cross-site-scripting-xss-vulnerability?_s_id=cve

Apr 23, 2026 3:45 PM Weaknesses updated. References updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-79
References	https://patchstack.com/database/wordpress/plugin/wp-stats-manager/vulnerability/wordpress-wp-visitor-statistics-real-time-traffic-plugin-8-2-cross-site-scripting-xss-vulnerability?_s_id=cve

Apr 23, 2026 3:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) allows Stored XSS. This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through 8.2.	Deserialization of Untrusted Data vulnerability in osama.esh PressApps Knowledge Base Contextual Sidebar Addon pressapps-knowledge-base allows Object Injection.This issue affects PressApps Knowledge Base Contextual Sidebar Addon: from n/a through <= 4.2.1.
Title	WordPress WP Visitor Statistics (Real Time Traffic) Plugin <= 8.2 - Cross Site Scripting (XSS) Vulnerability	WordPress PressApps Knowledge Base Contextual Sidebar Addon Plugin <= 4.2.1 - PHP Object Injection Vulnerability
Weaknesses		CWE-502
References		https://patchstack.com/database/Wordpress/Plugin/pressapps-knowledge-base/vulnerability/wordpress-pressapps-knowledge-base-contextual-sidebar-addon-plugin-4-2-1-php-object-injection-vulnerability?_s_id=cve
Metrics	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Aug 20, 2025 6:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 20, 2025 8:15 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) allows Stored XSS. This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through 8.2.
Title		WordPress WP Visitor Statistics (Real Time Traffic) Plugin <= 8.2 - Cross Site Scripting (XSS) Vulnerability
Weaknesses		CWE-79
References		https://patchstack.com/database/wordpress/plugin/wp-stats-manager/vulnerability/wordpress-wp-visitor-statistics-real-time-traffic-plugin-8-2-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}`