CVE-2026-97341 in Visitor Traffic Real Time Statistics Plugin
Summary
by MITRE • 10/03/2026
The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header in all versions up to, and including, 8.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires no authentication, no nonce, and no capability — the wp_ajax_nopriv_ahcfree_track_visitor endpoint accepts the forged X-Real-IP header from any unauthenticated HTTP request and stores the entity-encoded payload verbatim in the database.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/03/2026
The vulnerability identified within the Visitor Traffic Real Time Statistics plugin for WordPress, affecting versions up to 8.16, represents a critical security flaw classified as Stored DOM-Based Cross-Site Scripting. This specific type of injection occurs when an application accepts untrusted data and stores it without proper validation or sanitization, subsequently rendering that data in a web page where the browser executes it as part of its Document Object Model processing. In this instance, the vulnerability is triggered via the X-Real-IP HTTP header, which is commonly used by reverse proxies to pass the original client IP address to backend servers. The plugin fails to adequately sanitize or escape input derived from this header before storing it in the database, creating a direct pathway for malicious script injection that persists on the server side rather than being limited to immediate execution within a single request session.
The technical mechanism of exploitation relies on the wp_ajax_nopriv_ahcfree_track_visitor endpoint, which is designed to handle AJAX requests from unauthenticated users without requiring any form of nonces or capability checks. This lack of access control allows attackers to send crafted HTTP requests containing malicious payloads within the X-Real-IP header directly to this endpoint. Because the plugin stores the entity-encoded payload verbatim in the database, the injected script remains persistent across multiple page loads and user sessions. When a legitimate administrator or any other user subsequently views pages that display visitor statistics or related data retrieved from this compromised database entry, their browser parses the stored content as executable JavaScript code rather than plain text. This execution happens within the context of the victim's session, granting the attacker significant leverage over the client-side environment.
The operational impact of this vulnerability is severe due to its unauthenticated nature and persistent storage characteristics. Attackers can achieve arbitrary web script injection without needing valid credentials, bypassing standard WordPress authentication mechanisms entirely. Once executed, the injected scripts can perform a wide range of malicious activities including session hijacking by stealing administrator cookies, keylogging user inputs such as passwords or sensitive data, performing actions on behalf of authenticated users through Cross-Site Request Forgery techniques, and defacing website content. The persistence of the payload means that every visitor to the affected pages becomes a potential victim, amplifying the scope of damage significantly compared to reflected XSS vulnerabilities which require specific interaction with a crafted link for each instance of exploitation.
From an industry standards perspective, this vulnerability aligns closely with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting and specifically falls under Stored DOM-Based variants where the data is stored server-side before being rendered client-side. It also relates to CWE-601 URL Redirection to Untrusted Site which can be a vector for further attacks, though here the primary concern is script execution. In terms of MITRE ATT&CK mapping, this exploitation technique corresponds to T1059 Command and Scripting Interpreter: JavaScript within the Execution tactic, allowing attackers to run arbitrary code on client systems. It also touches upon T1534 Internal Spearphishing if used for credential harvesting against internal users, although primarily it is categorized under Client-Side Injection techniques aimed at compromising user sessions and data integrity.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. The most effective solution is to upgrade the Visitor Traffic Real Time Statistics plugin to a version newer than 8.16 where this vulnerability has been patched by implementing proper input validation and output encoding practices. Administrators should ensure that all plugins are kept up-to-date with their latest stable releases provided by vendors, as these updates typically include fixes for known security flaws. In the interim before upgrading, if possible, restricting access to WordPress admin areas via IP whitelisting or two-factor authentication can reduce exposure, although this does not fully mitigate the risk since the endpoint is unauthenticated and accessible from any source. Additionally, implementing a Web Application Firewall with rules capable of detecting and blocking anomalous patterns in HTTP headers such as X-Real-IP containing script tags or encoded JavaScript payloads can provide an additional layer of defense against exploitation attempts while patching efforts are underway.