Visitor Traffic Real Time Statistics (<= 8.16)

An unauthenticated Stored DOM-Based XSS vulnerability in the Visitor Traffic Real Time Statistics plugin allows attackers to inject malicious scripts via the 'X-Real-IP' header.