CVE-2026-2936: XSS in Visitor Traffic Real Time Statistics

An attacker can exploit this XSS vulnerability by injecting malicious JavaScript code into the 'page_title' parameter within the plugin. When an administrator accesses the Traffic by Title section, the injected script will execute in their browser context. This allows the attacker to steal session cookies, redirect the administrator to a phishing site, or deface the website. The impact is particularly severe because it targets administrator accounts, granting the attacker significant control over the WordPress site. Successful exploitation could lead to complete website takeover and data breaches.

1. Reserved2026-02-21
2. Published2026-04-04
3. Modified2026-04-08
4. EPSS updated2026-04-11

The primary mitigation for CVE-2026-2936 is to immediately upgrade the Visitor Traffic Real Time Statistics plugin to version 8.5 or later. If upgrading is not immediately feasible, consider temporarily restricting access to the Traffic by Title section to prevent administrators from being exposed to the vulnerability. While a direct workaround isn't available, implementing a Web Application Firewall (WAF) rule to filter suspicious input in the 'pagetitle' parameter could provide an additional layer of defense. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload into the 'pagetitle' field and verifying that it does not execute.

Active installs

30KKnown

Plugin rating