CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) allows Stored XSS. This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through 8.2.
Explanation of Vulnerability in Simple Terms
WP Visitor Statistics (Real Time Traffic) version 8.2 and earlier contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts into the site without user interaction. The vulnerability affects the plugin's core functionality and can lead to unauthorized access, data theft, or site compromise. All users should update immediately.
What an attacker can do
Inject and execute malicious JavaScript code on the site, affecting all visitors and administrators.
Potential impact on your site
Attackers can steal admin credentials, deface content, inject malware, or redirect visitors to phishing sites.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
