This vulnerability in the WP Visitor Statistics (Real Time Traffic) plugin allows an attacker to inject malicious scripts via improper input neutralization during web page generation, leading to DOM-based XSS. The issue affects all versions up to 8.3. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low complexity, requiring privileges and user interaction, and impacts confidentiality, integrity, and availability to a limited extent.

Successful exploitation can lead to limited confidentiality, integrity, and availability impacts due to DOM-based XSS. An attacker with privileges and requiring user interaction could execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking or other client-side attacks. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, users should consider restricting privileges and minimizing exposure to untrusted input in the affected plugin. Monitor vendor communications for updates.