CVE-2023-0600criticalobserved exploitation

CVE-2023-0600: critical vulnerability in WP Visitor Statistics (Real Time Traffic)

WP Visitor Statistics (Real Time Traffic) < 6.9 - Unauthenticated SQLi

Published · Updated

Follow this CVE+ Monitor WP Visitor Statistics

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

85Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 9.8epss 4.2%
from disclosure to weapon
Published on NVDMay 15
VulnCheck+757d
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.9 does not escape user input which is concatenated to an SQL query, allowing unauthenticated visitors to conduct SQL Injection attacks.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · WP Visitor Statistics (Real Time Traffic)
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — WP Visitor Statistics (Real Time Traffic)

In the same product, most dangerous first.

CVE-2021-24750—WP Visitor Statistics (Real Time Traffic) < 4.8 - Subscriber+ SQL InjectionEPSS 38.3%CVE-2022-0410—WP Visitor Statistics (Real Time Traffic) < 5.6 - Subscriber+ SQL InjectionEPSS 1.3%CVE-2021-25042—WP Visitor Statistics (Real Time Traffic) < 5.5 - Arbitrary IP Address Exclusion to Stored XSSEPSS 0.5%CVE-2022-4656MEDIUMWP Visitor Statistics (Real Time Traffic) < 6.5 - Contributor+ Stored XSS via ShortcodeEPSS 0.5%CVE-2026-117571HIGHWP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker Device ParametersEPSS 0.3%CVE-2026-117572MEDIUMWP Visitor Statistics (Real Time Traffic) < 8.8 - Admin+ SQLi via 'order' ParameterEPSS 0.2%