Visitor Traffic Real Time Statistics < 8.16 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' and Forwarded-IP HTTP Headers
- ID
- WPSEC-2026-0168
- Plugin
- Visitor Traffic Real Time Statistics (visitors-traffic-real-time-statistics)
- Affected
- from 8.9 before 8.16
- Remediation
- Update to 8.16 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Visitor Traffic Real Time Statistics on WPSec AttackSurface
- Fix released
- Published
Description
The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'X-Real-IP', 'Client-IP', 'X-Forwarded-For' and other forwarded-IP HTTP headers in versions 8.9 up to, and including, 8.14 (8.15 was never released). The unauthenticated visitor tracker (the 'ahcfree_track_visitor' AJAX action) takes the visitor IP address from these client-supplied headers and stores it after only sanitize_text_field(), which leaves HTML entities such as '<' intact. The Recent Visitors table writes the stored value into a data attribute of the visit-count button, where the browser decodes the entities, and the IP details popup then inserts the decoded value into the page as HTML without escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator opens the forged visitor's IP details in the plugin's statistics dashboard.
References
- https://wpsec.com/vuln/WPSEC-2026-0168/
- https://plugins.svn.wordpress.org/visitors-traffic-real-time-statistics/tags/8.16/
- https://wordpress.org/plugins/visitors-traffic-real-time-statistics/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS