WordPress WP Visitor Statistics (Real Time Traffic) Plugin <= 8.2 - Vulnérabilité Cross Site Scripting (XSS)

The impact of this XSS vulnerability is significant. An attacker could inject arbitrary JavaScript code into the plugin's data storage, which would then be executed in the browsers of any user visiting a page displaying data from the plugin. This could lead to various malicious actions, including session hijacking, redirection to phishing sites, defacement of the website, and theft of sensitive user data, such as cookies and login credentials. The attacker could potentially gain complete control over the user's browsing session, impersonate them, and access restricted areas of the website. Given the plugin's function of tracking visitor statistics, a large number of users could be exposed to this risk.

WordPress websites utilizing the WP Visitor Statistics (Real Time Traffic) plugin are at risk. Sites with high traffic volumes or those that collect sensitive user data are particularly vulnerable. Shared hosting environments where plugin updates are managed by the hosting provider may also be at increased risk if updates are not applied promptly.

• wordpress / composer / npm:

grep -r "osama.esh/wp-visitor-statistics" /var/www/html/wp-content/plugins/
wp plugin list | grep "WP Visitor Statistics"

• generic web:

curl -I https://your-wordpress-site.com/ | grep Content-Security-Policy

1. 2025-08-20Disclosure

   disclosure

1. Réservé2025-06-04
2. Publiée2025-08-20
3. Modifiée2026-04-28
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-49400 is to immediately upgrade the WP Visitor Statistics (Real Time Traffic) plugin to version 8.2.1 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider temporarily disabling the plugin to prevent further exploitation. While a direct WAF rule is difficult to implement due to the nature of stored XSS, implementing strict Content Security Policy (CSP) headers can help mitigate the impact by restricting the sources from which scripts can be executed. Regularly scan your WordPress installation for vulnerabilities using a reputable security plugin.

Installations actives

20KConnu

Note du plugin