A WordPress plugin records the value supplied in the page_title field of the ahcpro_track_visitor AJAX action without any sanitization. When an administrator later opens the plugin dashboard, the stored value is inserted into the page as raw innerHTML, causing JavaScript to execute in the administrator’s session. This flaw lets a non‑authenticated attacker inject code that runs with the privileges of any logged‑in administrator, potentially allowing credential theft, defacement, or further compromises. The weakness is a classic Stored Cross‑Site Scripting flaw (CWE‑79).

Any WordPress site using the Visitors Traffic Real Time Statistics Pro plugin version 11.22 or older. The affected product is distributed by wp‑buy under the name Visitors Traffic Real Time Statistics pro. No version numbers beyond 11.22 are impacted as newer releases presumably address the issue.

The CVSS base score is 7.2, indicating a high severity vulnerability. EPSS is not available, and the flaw is not listed in the CISA KEV catalog, suggesting no known public exploits at the time of this analysis. The attack vector is inferred as unauthenticated because the AJAX action is registered for logged‑out callers (wp_ajax_nopriv_ahcpro_track_visitor). An attacker can submit a malicious payload via any HTTP POST to the action, which is stored unfiltered. When an administrator accesses the traffic dashboard, the payload executes in his browser context, providing a convenient privilege escalation path.