VulnSocial

CVE-2026-2936Disclosure

LOWCVSS 7.2 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_title' parameter in all versions up to, and including, 8.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an admin user accesses the Traffic by Title section.

Back to dashboard
3.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 2 mentions (2026-04-04); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-04-04: 2Mentions · 2026-04-11: 1PoC Mentioned / Linked · 2026-04-11: 1Exploit Tool / Code · 2026-04-11: 1Technical Details · 2026-04-04: 204-0404-11
Signal classification2 categories
Disclosure
266.7%
PoC
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-04-042
Disclosure2
2026-04-111
PoC1
Full discourse3 posts
  • Atomic Edge@atomicedgeWAF
    PoC

    https://atomicedge.io/cve-proof/cve-2026-2936-visitors-traffic-real-time-statistics-version-8-4-high-vulnerability-proof-of-concept CVE-2026-2936 #WordPress plugin #vulnerability visitors-traffic-real-time-statistics #cybersecurity #wordpressfirewall #wordpresssecurity #hackin…

    Post summary

    A proof‑of‑concept for CVE‑2026‑2936 targeting the Visitors‑Traffic‑Real‑Time‑Statistics WordPress plugin is indicated, but no evidence of active exploitation, patching, or technical details is provided.

    0000052
    6 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-2936 The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_title' parameter in all versions up to, and inc… https://www.cve.org/CVERecord?id=CVE-2026-2936

    Post summary

    The CVE announces a stored XSS vulnerability in the Visitor Traffic Real Time Statistics WordPress plugin, affecting all prior versions, but does not provide proof‑of‑concept, exploit code, or patch information.

    00000133
    57.0K followersView on X
  • CyberDudeBivash® | Global Cybersecurity Company@cyberbivash
    Disclosure

    🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-2936 - Visitor Traffic Real Time Statistics <= 8.4 - Unauthenticated Stored Cross-Site Scripting Intel Report: https://ift.tt/AgKePfN

    Post summary

    A new CVE-2026-2936 vulnerability has been announced, describing an unauthenticated stored XSS in the Visitor Traffic Real Time Statistics module (≤8.4). An Intel Report link is provided, but no PoC, exploit, active use, or patch information is disclosed.

    0000055
    281 followersView on X

Explore more

Back to dashboard