प्लेटफ़ॉर्म
wordpress
घटक
visitors-traffic-real-time-statistics
में ठीक किया गया
8.4.1
CVE-2026-2936 describes a Stored Cross-Site Scripting (XSS) vulnerability affecting the Visitor Traffic Real Time Statistics plugin for WordPress. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts, potentially leading to account compromise and data theft. The vulnerability impacts versions 0.0.0 through 8.4 and has been resolved in version 8.5.
An attacker can exploit this XSS vulnerability by injecting malicious JavaScript code into the 'page_title' parameter within the plugin. When an administrator accesses the Traffic by Title section, the injected script will execute in their browser context. This allows the attacker to steal session cookies, redirect the administrator to a phishing site, or deface the website. The impact is particularly severe because it targets administrator accounts, granting the attacker significant control over the WordPress site. Successful exploitation could lead to complete website takeover and data breaches.
CVE-2026-2936 was publicly disclosed on 2026-04-04. No public proof-of-concept (PoC) code has been released at the time of writing, but the vulnerability's simplicity suggests it is likely to be exploited. It is not currently listed on the CISA KEV catalog. The ease of exploitation makes it a potential target for automated scanning and exploitation campaigns.
WordPress websites utilizing the Visitor Traffic Real Time Statistics plugin, particularly those running older versions (0.0.0–8.4), are at risk. Sites with limited security monitoring and those where administrators frequently access the Traffic by Title section are especially vulnerable.
• wordpress / composer / npm:
grep -r "page_title'" /var/www/html/wp-content/plugins/visitor-traffic-real-time-statistics/• wordpress / composer / npm:
wp plugin list --status=active | grep 'visitor-traffic-real-time-statistics'• wordpress / composer / npm:
wp plugin update visitor-traffic-real-time-statistics --alldisclosure
एक्सप्लॉइट स्थिति
EPSS
0.02% (6% शतमक)
CISA SSVC
CVSS वेक्टर
The primary mitigation for CVE-2026-2936 is to immediately upgrade the Visitor Traffic Real Time Statistics plugin to version 8.5 or later. If upgrading is not immediately feasible, consider temporarily restricting access to the Traffic by Title section to prevent administrators from being exposed to the vulnerability. While a direct workaround isn't available, implementing a Web Application Firewall (WAF) rule to filter suspicious input in the 'pagetitle' parameter could provide an additional layer of defense. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload into the 'pagetitle' field and verifying that it does not execute.
संस्करण 8.5 में अपडेट करें, या एक नया पैच किया गया संस्करण
भेद्यता विश्लेषण और गंभीर अलर्ट सीधे आपके ईमेल में।
CVE-2026-2936 is a Stored Cross-Site Scripting (XSS) vulnerability in the Visitor Traffic Real Time Statistics WordPress plugin, allowing attackers to inject malicious scripts.
You are affected if you are using the Visitor Traffic Real Time Statistics plugin in WordPress versions 0.0.0 through 8.4.
Upgrade the Visitor Traffic Real Time Statistics plugin to version 8.5 or later to resolve the vulnerability.
While no public exploits are currently known, the vulnerability's simplicity suggests it may be targeted by attackers.
Refer to the plugin developer's website or WordPress plugin repository for the official advisory and update information.
अपनी डिपेंडेंसी फ़ाइल अपलोड करें और तुरंत जानें कि यह CVE और अन्य आपको प्रभावित करती हैं या नहीं।
अपनी डिपेंडेंसी फ़ाइल अपलोड करें और तुरंत जानें कि यह CVE और अन्य आपको प्रभावित करती हैं या नहीं।