CVE-2025-14151
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2Description
The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'outbound_resource' parameter in the slimtrack AJAX action in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Analysis
Stored XSS in SlimStat Analytics for WordPress allows unauthenticated attackers to inject malicious scripts via unsanitized 'outbound_resource' parameter in slimtrack AJAX action (versions ≤5.3.2). Injected scripts execute when any user accesses the compromised page, enabling session hijacking, credential theft, or privilege escalation. Affects all installations with publicly accessible AJAX endpoints. No public exploit identified at time of analysis.
Technical Context
Insufficient input sanitization in slimtrack AJAX handler allows raw user input from 'outbound_resource' to persist in database without encoding. CWE-79 violation occurs where stored payloads render unescaped in admin/view/right-now.php:273 and wp-slimstat-reports.php:1341. CVSS vector PR:N confirms unauthenticated exploitation surface via WordPress AJAX infrastructure.
Affected Products
SlimStat Analytics (wp-slimstat) plugin for WordPress by Slimstat, versions 5.3.2 and earlier. CPE: cpe:2.3:a:wp-slimstat:slimstat_analytics:*:*:*:*:*:wordpress:*:* (versions up to 5.3.2 inclusive). All WordPress installations with vulnerable plugin versions enabled.
Remediation
Upstream fix available (changeset 3421814); released patched version not independently confirmed. Per Wordfence advisory, sanitization and output escaping logic implemented to neutralize XSS vectors in slimtrack handler. Review changeset at https://plugins.trac.wordpress.org/changeset/3421814/wp-slimstat/trunk?contextall=1&old=3401545&old_path=%2Fwp-slimstat%2Ftrunk#file4 and update plugin immediately when version post-5.3.2 becomes available via WordPress repository. Temporary workaround: disable or remove SlimStat Analytics plugin until patch deployment, or restrict wp-admin/admin-ajax.php access to authenticated users only via web application firewall rules. Audit existing database records for injected JavaScript payloads. Consult full technical details at https://www.wordfence.com/threat-intel/vulnerabilities/id/6ee675dd-5b43-439f-9717-6c531e9bf066?source=cve for additional context.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today