Stored DOM-Based XSS in Visitor Traffic Real Time Statistics WordPress Plugin

The Visitor Traffic Real Time Statistics plugin for WordPress, in versions 8.16 and earlier, is susceptible to a Stored DOM-Based Cross-Site Scripting (XSS) vulnerability. The flaw exists because the plugin fails to properly sanitize or escape input provided via the 'X-Real-IP' HTTP header before storing it in the WordPress database. This vulnerability is reachable through the 'wp_ajax_nopriv_ahcfree_track_visitor' endpoint, which does not require any authentication, nonces, or administrative capabilities. Consequently, an unauthenticated attacker can supply a crafted JavaScript payload in the 'X-Real-IP' header, which is then persisted in the site database. Whenever an administrator or other user accesses the affected page within the WordPress dashboard or public-facing tracking views, the stored script executes in the victim's browser, potentially leading to session hijacking, unauthorized actions, or further compromise of the WordPress environment.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of any user viewing the statistics page. This can lead to full compromise of administrative sessions, theft of authentication cookies, or the redirection of site visitors to malicious external sites. The impact is elevated due to the lack of required authentication, allowing wide-scale automated scanning and exploitation of affected WordPress installations globally.

Recommendation

Prioritize updating the Visitor Traffic Real Time Statistics plugin to the latest version. Monitor web server access logs for anomalous 'X-Real-IP' header values containing suspicious characters (e.g., <, >, script, alert). Deploy Web Application Firewall (WAF) rules to inspect the 'X-Real-IP' header for web script signatures before the request reaches the WordPress application.