This vulnerability in the WP Visitor Statistics (Real Time Traffic) plugin (osama.esh) allows stored cross-site scripting due to improper input neutralization during web page generation. Attackers with at least low privileges and requiring user interaction can inject malicious scripts that execute in the context of other users, potentially leading to partial compromise of confidentiality, integrity, and availability. The issue affects all versions up to 7.8. No patch or official remediation guidance has been published yet.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to data disclosure, modification, or disruption of service. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and scope change, with low confidentiality, integrity, and availability impacts. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider limiting plugin usage or applying manual input sanitization if feasible. Monitor official sources for updates and apply patches promptly once released.