Wp Visitor Statistics (Real Time Traffic)
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:wp_visitor_statistics_(real_time_traffic):*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Wp Visitor Statistics (Real Time Traffic) (b049697c-92c0-5957-9fd4-fe646a4f7bac) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-117572 |
vulnerable | 2026-11-03 10:15:34.290948 |
WP Visitor Statistics (Real Time Traffic) < 8.8 - Admin+ SQLi via 'order' Parameter
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement, allowing high-privilege users such as administrators to perform SQL injection attacks.
Published: 2026-10-30T06:00:23.528Z
Updated: 2026-10-30T13:26:47.112Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-117571 |
vulnerable | 2026-11-03 10:15:33.502053 |
WP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker Device Parameters
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a logged-in administrator views the statistics pages.
Published: 2026-10-30T06:00:23.349Z
Updated: 2026-10-30T13:26:47.266Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0600 |
vulnerable | 2026-06-08 05:52:32.046651 |
WP Visitor Statistics (Real Time Traffic) < 6.9 - Unauthenticated SQLi
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.9 does not escape user input which is concatenated to an SQL query, allowing unauthenticated visitors to conduct SQL Injection attacks.
Published: 2023-05-15T12:15:31.686Z
Updated: 2025-01-24T20:22:17.142Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4656 |
vulnerable | 2026-06-08 05:52:00.122475 |
WP Visitor Statistics (Real Time Traffic) < 6.5 - Contributor+ Stored XSS via Shortcode
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.5 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Published: 2023-02-13T14:32:19.074Z
Updated: 2025-03-20T18:36:55.634Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-0410 |
vulnerable | 2026-06-08 05:39:09.986293 |
WP Visitor Statistics (Real Time Traffic) < 5.6 - Subscriber+ SQL Injection
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.6 does not sanitise and escape the id parameter before using it in a SQL statement via the refUrlDetails AJAX action, available to any authenticated user, leading to a SQL injection
Published: 2022-03-07T08:16:31.000Z
Updated: 2024-08-02T23:25:40.346Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-25042 |
vulnerable | 2026-06-08 05:30:39.852138 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24750 |
vulnerable | 2026-06-08 05:30:39.139279 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.