{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/visitor-traffic-real-time-statistics--8.16/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:visitor_traffic_real_time_statistics_project:visitor_traffic_real_time_statistics:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-97341"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Visitor Traffic Real Time Statistics (\u003c= 8.16)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe Visitor Traffic Real Time Statistics plugin for WordPress, in versions 8.16 and earlier, is susceptible to a Stored DOM-Based Cross-Site Scripting (XSS) vulnerability. The flaw exists because the plugin fails to properly sanitize or escape input provided via the 'X-Real-IP' HTTP header before storing it in the WordPress database. This vulnerability is reachable through the 'wp_ajax_nopriv_ahcfree_track_visitor' endpoint, which does not require any authentication, nonces, or administrative capabilities. Consequently, an unauthenticated attacker can supply a crafted JavaScript payload in the 'X-Real-IP' header, which is then persisted in the site database. Whenever an administrator or other user accesses the affected page within the WordPress dashboard or public-facing tracking views, the stored script executes in the victim's browser, potentially leading to session hijacking, unauthorized actions, or further compromise of the WordPress environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of any user viewing the statistics page. This can lead to full compromise of administrative sessions, theft of authentication cookies, or the redirection of site visitors to malicious external sites. The impact is elevated due to the lack of required authentication, allowing wide-scale automated scanning and exploitation of affected WordPress installations globally.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize updating the Visitor Traffic Real Time Statistics plugin to the latest version. Monitor web server access logs for anomalous 'X-Real-IP' header values containing suspicious characters (e.g., \u0026lt;, \u0026gt;, script, alert). Deploy Web Application Firewall (WAF) rules to inspect the 'X-Real-IP' header for web script signatures before the request reaches the WordPress application.\u003c/p\u003e\n","date_modified":"2026-10-03T06:54:57Z","date_published":"2026-10-03T06:54:57Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-97341/","summary":"An unauthenticated Stored DOM-Based XSS vulnerability in the Visitor Traffic Real Time Statistics plugin allows attackers to inject malicious scripts via the 'X-Real-IP' header.","title":"Stored DOM-Based XSS in Visitor Traffic Real Time Statistics WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-97341/"}],"language":"en","title":"CraftedSignal Threat Feed - Visitor Traffic Real Time Statistics (\u003c= 8.16)","version":"https://jsonfeed.org/version/1.1"}