Threats tagged 'ghsa-r835-6v42-fm24'

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 8.7.1. This vulnerability arises from insufficient input sanitization and output escaping of the 'browser' parameter. An unauthenticated attacker can inject malicious scripts via an HTTP request to the public visitor tracking endpoint, which execute in the context of an authenticated administrator's browser when viewing affected pages.