WP Visitor Statistics (Real Time Traffic) vulnerabilities
We track 3 vulnerabilities in WP Visitor Statistics (Real Time Traffic) products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 30, 2026.
Latest WP Visitor Statistics (Real Time Traffic) vulnerabilities
- 8.8 High severity
WP Visitor Statistics (Real Time Traffic): Improper Neutralization of Input During Web Page Generation
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboard, allowing unauthenticated a
- 9.8 Critical severity
WP Visitor Statistics (Real Time Traffic): Improper Neutralization of Special Elements used in an SQL Command
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.9 does not escape user input which is concatenated to an SQL query, allowing unauthenticated visitors to conduct SQL Injection attacks.
- 8.8 High severity
WP Visitor Statistics (Real Time Traffic): Improper Neutralization of Special Elements used in an SQL Command
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.6 does not sanitise and escape the id parameter before using it in a SQL statement via the refUrlDetails AJAX action, available to any authenticated user, leading to a SQL injection