This vulnerability (CVE-2025-49400) in the WP Visitor Statistics (Real Time Traffic) plugin allows stored cross-site scripting due to improper input sanitization during web page generation. Attackers can inject malicious scripts that persist and execute when other users view affected pages. The issue affects versions up to 8.2 and has a CVSS 3.1 base score of 9.8, reflecting network attack vector, low complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently provided.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users' browsers, potentially leading to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability of affected systems. The vulnerability is critical due to its high CVSS score and the nature of stored XSS.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or removing the WP Visitor Statistics (Real Time Traffic) plugin if feasible. Implementing web application firewall (WAF) rules to detect and block XSS payloads may provide temporary mitigation. Monitor official sources for updates.