CVE-2026-4303 is a stored cross-site scripting vulnerability in the WP Visitor Statistics (Real Time Traffic) WordPress plugin, affecting all versions up to and including 8.4. The issue arises from improper input sanitization and output escaping of user-supplied attributes in the 'wsm_showDayStatsGraph' shortcode. Authenticated attackers with contributor-level privileges or higher can inject arbitrary web scripts that execute in the context of users visiting the injected pages. This vulnerability can lead to information disclosure and limited integrity impacts but does not affect availability. The CVSS 3.1 base score is 6.4 (medium severity) with network attack vector, low attack complexity, privileges required, no user interaction, and scope changed.

Successful exploitation allows authenticated users with contributor or higher privileges to inject and execute arbitrary scripts in the context of other users viewing the affected pages. This can lead to limited confidentiality and integrity impacts such as session hijacking, unauthorized actions, or data theft. There is no impact on system availability. No known active exploits have been reported.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. As a temporary mitigation, restrict contributor-level access if possible and avoid using the vulnerable shortcode until a fix is released. Review and sanitize user inputs related to the shortcode manually if feasible.