CVE-2021-25042: WP Visitor Statistics (Real Time Traffic) < 5.5 - Arbitrary IP Address Exclusion to Stored XSS

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-02-28 · updated 2026-06-17
Weakness: CWE-862

Description

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.5 does not have authorisation and CSRF checks in the updateIpAddress AJAX action, allowing any authenticated user to call it, or make a logged in user do it via a CSRF attack and add an arbitrary IP address to exclude. Furthermore, due to the lack of validation, sanitisation and escaping, users could set a malicious value and perform Cross-Site Scripting attacks against logged in admin

Affected products

WP Visitor Statistics (Real Time Traffic): before 5.5 — fixed in 5.5

How to fix

Upgrade to a fixed version: WP Visitor Statistics (Real Time Traffic) 5.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-25042 or the next vulnerability affects your stack