Is WP Visitor Statistics (Real Time Traffic) safe?

Every recorded flaw

• Oct 28, 2026WP Visitor Statistics (Real Time Traffic): SQL InjectionCVE-2026-116609 · affects up to 8.8 · reported by WordfenceMedium 6.5
• Oct 3, 2026WP Visitor Statistics (Real Time Traffic): Generic SQL InjectionCVE-2026-96267 · affects up to 8.7 · reported by WordfenceHigh 7.5
• Apr 8, 2026WP Visitor Statistics (Real Time Traffic): Stored Cross-Site ScriptingCVE-2026-4303 · affects up to 8.4 · reported by WordfenceMedium 6.4
• Dec 16, 2025WP Visitor Statistics (Real Time Traffic): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67983 · affects up to 8.3 · reported by PatchstackMedium 6.5
• Aug 20, 2025WP Visitor Statistics (Real Time Traffic): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49400 · affects up to 8.2 · reported by PatchstackCritical 9.8
• Jul 4, 2025WP Visitor Statistics (Real Time Traffic): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53566 · affects up to 7.8 · reported by PatchstackMedium 6.5
• Jun 20, 2025WP Visitor Statistics (Real Time Traffic): Missing AuthorizationCVE-2025-49996 · affects up to 8.4 · reported by PatchstackMedium 5.3
• Jan 24, 2025WP Visitor Statistics (Real Time Traffic): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24675 · affects up to 7.2 · reported by PatchstackMedium 6.5
• Jan 7, 2025WP Visitor Statistics (Real Time Traffic): Missing AuthorizationCVE-2025-22304 · affects up to 7.5 · reported by PatchstackMedium 4.3
• Mar 17, 2024WP Visitor Statistics (Real Time Traffic): Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-24867 · affects up to 6.9.4 · reported by PatchstackMedium 5.3
• May 15, 2023WP Visitor Statistics (Real Time Traffic): Does not escape user inputCVE-2023-0600 · fixed in 6.9 · reported by WPScan4.2% oddsCritical 9.8
• Feb 13, 2023WP Visitor Statistics (Real Time Traffic): Does not validate and escape one of its shortcode attributesCVE-2022-4656 · fixed in 6.5 · reported by WPScanMedium 5.4
• Jul 25, 2022Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities in Osamaesh WP Visitor Statistics plugin <= 5.7 at WordPress.CVE-2022-33965 · affects up to 5.7 · reported by Patchstack4.4% oddsCritical 9.3
• Mar 7, 2022WP Visitor Statistics (Real Time Traffic): Does not sanitise and escape the id parameter before using it in a SQL statement via the refUrlDetails AJAX actionCVE-2022-0410 · fixed in 5.6 · reported by WPScan1.3% oddsHigh 8.8
• Feb 28, 2022WP Visitor Statistics (Real Time Traffic): Does not have authorisation and CSRF checks in the updateIpAddress AJAX actionCVE-2021-25042 · fixed in 5.5 · reported by WPScanMedium 5.4
• Dec 21, 2021WP Visitor Statistics (Real Time Traffic): Does not properly sanitise and escape the refUrl in the refDetails AJAX actionCVE-2021-24750 · fixed in 4.8 · reported by WPScan38% oddsHigh 8.8

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.