Visitor Traffic Real Time Statistics <= 8.16 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-97341 · Microsoft / collected KEV context

cve-program · CVE-2026-97341

• https://www.wordfence.com/threat-intel/vulnerabilities/id/5349815d-a9e4-431a-8da7-0d7d68b7d427?source=cve
• https://plugins.trac.wordpress.org/browser/visitors-traffic-real-time-statistics/tags/8.14/functions.php#L4735
• https://plugins.trac.wordpress.org/browser/visitors-traffic-real-time-statistics/tags/8.14/functions.php#L3756
• https://plugins.trac.wordpress.org/browser/visitors-traffic-real-time-statistics/tags/8.14/functions.php#L3407
• https://plugins.trac.wordpress.org/browser/visitors-traffic-real-time-statistics/tags/8.14/WPHitsCounter.php#L877
• https://plugins.trac.wordpress.org/browser/visitors-traffic-real-time-statistics/tags/8.14/js/ahcfree_js_scripts.js#L1036
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3722792%40visitors-traffic-real-time-statistics&new=3722792%40visitors-traffic-real-time-statistics

No related operational record is retained in the current change model.