Description
Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.21 versions.
Published: 2026-09-17
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Cross Site Scripting
Action: Patch Now
AI Analysis

Impact

Unauthenticated Cross Site Scripting (XSS) is present in Visitor Traffic Real Time Statistics Pro plugin versions 11.21 and earlier, allowing an attacker to inject arbitrary script into pages viewed by site visitors. This can lead to credential theft, defacement, or other client‑side compromises. The weakness is a classic input validation flaw classified as CWE-79.

Affected Systems

The vulnerability affects the WordPress plugin Visitor Traffic Real Time Statistics Pro from CODEPRESS IT Solutions LLC, specifically all releases up to and including version 11.21. It is relevant to any WordPress site that has this plugin installed and active.

Risk and Exploitability

With a CVSS score of 7.1 the vulnerability is considered high severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, suggesting no known large‑scale exploitation yet. Based on the description, the likely attack vector is an unauthenticated user visiting a crafted URL or manipulating query parameters in the statistics page, triggering the injected script.

Generated by OpenCVE AI on September 17, 2026 at 21:23 UTC.

Remediation

Vendor Solution

Update the WordPress Visitor Traffic Real Time Statistics Pro Plugin to the latest available version (at least 11.22).

OpenCVE Recommended Actions

  • Update the WordPress Visitor Traffic Real Time Statistics Pro Plugin to version 11.22 or later.
  • Disable or uninstall the plugin if an update is not immediately possible.
  • Restrict access to the statistics feature to trusted user roles or IP addresses to limit the spread of any injected scripts.

Generated by OpenCVE AI on September 17, 2026 at 21:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Codepress It Solutions Llc
Codepress It Solutions Llc visitor Traffic Real Time Statistics Pro
Wordpress
Wordpress wordpress
Vendors & Products Codepress It Solutions Llc
Codepress It Solutions Llc visitor Traffic Real Time Statistics Pro
Wordpress
Wordpress wordpress

Thu, 17 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 17 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Description Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.21 versions.
Title WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.21 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Codepress It Solutions Llc Visitor Traffic Real Time Statistics Pro
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-09-17T14:42:47.713Z

Reserved: 2026-09-14T13:54:03.572Z

Link: CVE-2026-90986

cve-icon Vulnrichment

Updated: 2026-09-17T14:42:40.331Z

cve-icon NVD

Status : Deferred

Published: 2026-09-17T14:17:52.867

Modified: 2026-09-17T21:12:30.593

Link: CVE-2026-90986

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T21:30:18Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')