Read the docs
TI-2026-81755 Aliases CVE-2026-116609GHSA-977q-pq7w-wxx3

SQL injection in WP Visitor Statistics plugin via shortcode attribute

Priority LOW 29CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress in versions up to and including 8.8 is vulnerable to SQL injection (CWE-89). The 'from' shortcode attribute of the [wsm_showTrafficStatsList] shortcode is concatenated into an SQL query without sufficient escaping. An authenticated attacker with Contributor access or higher can append SQL queries to existing ones and extract sensitive information from the database.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to SQL Injection via the 'from' (and sibling 'to'/'first'/'second') shortcode attribute of the [wsm_showTrafficStatsList] shortcode in versions up to, and including, 8.8 This is due to insufficient escaping on the user-supplied attribute and lack of sufficient preparation on the existing SQL query: `shortcode_atts()` returns attacker-supplied shortcode attributes verbatim (WP core performs no sanitization), only `$atts['id']` is re-sanitized afterward, and the raw value is then concatenated into a double-quoted SQL string literal inside `fnGetHourlyReportByDateNameTimeZone()` (`includes/wsm_db.php:1449`) and executed via `$wpdb->get_results()`. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00336 27th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
osama.eshWP Visitor Statistics (Real Time Traffic)up to 8.8—No fix listedCNA
  • WP Visitor Statistics (Real Time Traffic) Vendorosama.esh Affected up to 8.8 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for WP Visitor Statistics (Real Time Traffic).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-116609
  2. 2026-10-28 Alias added: GHSA-977q-pq7w-wxx3
  3. 2026-10-28 Priority changed: MEDIUM → LOW
  4. 2026-10-29 CISA SSVC decision points changed

References

Other 6

  • TI-2025-31448 WordPress WP Visitor Statistics (Real Time Traffic) Plugin <= 8.2 - Cross Site Scripting (XSS) Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2026-67464 WP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthenticated SQL Injection via 'fullRef' Parameter CVSS 3.1HIGH 7.5
  • TI-2025-31911 WordPress WP Visitor Statistics (Real Time Traffic) plugin <= 8.4 - Broken Access Control vulnerability CVSS 3.1MEDIUM 5.3
  • TI-2026-86545 Stored cross-site scripting in WP Visitor Statistics WordPress plugin CVSS 3.1HIGH 7.2
  • TI-2026-86542 Stored cross-site scripting in WP Visitor Statistics plugin CVSS 3.1HIGH 7.2
  • TI-2025-18392 WordPress WP Visitor Statistics (Real Time Traffic) plugin <= 7.2 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences