The vulnerability allows an unauthenticated attacker to store malicious scripts in the "browser" parameter of the WP Visitor Statistics plugin. Because the input is not properly sanitized or escaped, the payload is embedded in the reading of visitor data and will execute in the browser of any user who views the injected page. This results in a stored XSS that runs in the context of authenticated administrators, allowing an attacker to steal session cookies or perform unauthorized actions on behalf of the site owner. The weakness is a classic cross‑site scripting flaw (CWE‑79).

WordPress sites running the WP Visitor Statistics (Real Time Traffic) plugin version 8.7.1 or earlier are affected. The issue resides in the plugin’s public visitor‑tracking endpoint and the admin interface that renders the visitor statistics. Users of any WordPress installation that has this plugin installed without an updated version are at risk.

The CVSS score of 7.2 indicates a high severity that can impact the confidentiality and integrity of administrative sessions. The EPSS score is not available, so the current exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Attackers need only send a crafted HTTP request with a malicious value for the "browser" parameter to the public wmcAction=wmcTrack endpoint; no authentication is required. Once injected, the payload will execute every time an administrator views the statistics page, providing a persistent vector for session hijacking or other malicious actions.