Visitor Traffic Real Time Statistics pro v11.23

* Security: fixed an unauthenticated stored XSS vulnerability via the "page_title" parameter of the visitor-tracking endpoint (ahcpro_track_visitor). A crafted page title could be stored in the title-traffic table and execute in the admin dashboard when the "Traffic by Title" table was loaded. Page titles, user agents and referers are now stripped of any HTML on storage (both in the AJAX handler and in the hit counter itself), and page titles and links are escaped on output, so payloads stored by older versions can no longer execute either. The Excel export keeps clean, readable titles. * Security: fixed reflected XSS in the dashboard date-range search fields, which echoed submitted values back into the page without escaping. * Security: hardened output escaping in the "Latest Search Words" block and in the mobile-app REST API (page titles, keywords and referers are no longer returned with markup). * Hardening: admin redirects now use wp_safe_redirect(), and the database index upgrade routine validates table/index identifiers before running.