The vulnerability resides in the WP Visitor Statistics (Real Time Traffic) plugin for WordPress. It allows injected script code to be stored via the 'os', 'browser', and 'res' tracker parameters because the plugin does not sanitize or escape these inputs properly. An unauthenticated attacker can place malicious JavaScript that will execute whenever a site visitor loads an affected page, resulting in client‑side code execution on any user of the website. This can facilitate session hijacking, defacement, or the distribution of malware to site visitors.

The affected product is the WordPress plugin WP Visitor Statistics (Real Time Traffic) produced by osamaesh. Versions up to and including 8.9.0 are vulnerable; the issue does not exist in versions released after that threshold.

The CVSS score of 7.2 indicates a high severity vulnerability. Without an EPSS score provided, the current exploitation probability is unclear, but the vulnerability is listed as not in CISA KEV, suggesting that active exploitation is not widely reported yet. The attack can be carried out without authentication by submitting malicious values for the 'os', 'browser', or 'res' parameters to the plugin’s tracking endpoint, allowing an attacker to compromise any user who browses the affected site.