CVE-2026-116609 | osamaesh WP Visitor Statistics Plugin up to 8.8 on WordPress Shortcode includes/wsm_db.php fnGetHourlyReportByDateNameTimeZone from/to/first/second sql injection

October 28, 2026 Yanac

A vulnerability marked as critical has been reported in osamaesh WP Visitor Statistics Plugin up to 8.8 on WordPress. This issue affects the function fnGetHourlyReportByDateNameTimeZone of the file includes/wsm_db.php of the component Shortcode Handler. The manipulation of the argument from/to/first/second leads to sql injection.

This vulnerability is traded as CVE-2026-116609. It is possible to initiate the attack remotely. There is no exploit available.VulDB Recent EntriesRead More