The WP Visitor Statistics (Real Time Traffic) WordPress plugin contains a stored cross‑site scripting weakness in the wsm_showDayStatsGraph shortcode. The plugin fails to sanitize or escape the user‑supplied "height" attribute, enabling attackers with contributor‑level or higher privileges to embed arbitrary JavaScript into pages. This represents a classic reflected XSS flaw (CWE‑79) that can compromise user confidentiality and session integrity.

The vulnerability is present in all releases of the WP Visitor Statistics (Real Time Traffic) plugin up to and including version 8.4, distributed by the vendor osamaesh. Any WordPress site that has installed this plugin and has users with contributor or higher roles is potentially affected.

The CVSS score of 6.4 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated user with contribution rights to insert the malicious attribute; once inserted, the script runs whenever any visitor loads the affected page. Because the flaw leads to arbitrary code execution in the context of the victim’s browser, it can result in session hijacking, data theft, or defacement. With a moderate probability of exploitation, deploying a patch or mitigating the attack surface is strongly recommended.