What is the CVSS score of CVE-2025-14151?

CVE-2025-14151 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of WordPress are affected by CVE-2025-14151?

SlimStat Analytics for WordPress versions 5.3.2 and earlier contains a stored cross-site scripting (XSS) vulnerability in the AJAX tracking endpoint that allows unauthenticated attackers to inject…

How to fix or mitigate CVE-2025-14151?

Within 24 hours: Disable or remove SlimStat Analytics plugin from all WordPress installations; verify no unauthorized script injections in analytics data via database inspection of the 'outbound_resource' parameter. Within 7 days: Audit user session logs and WordPress admin accounts for unauthorized access during plugin deployment period; reset credentials for all administrative users. Within 30 days: Monitor vendor advisory for patched version ≥5.3.3; implement Web Application Firewall (WAF) rules to block malicious payloads in AJAX requests if continued use is required; consider alternative analytics solutions.

WordPress CVE-2025-14151

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-12-19 security@wordfence.com

WordPress XSS

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 18:38 vuln.today

CVE Published

Dec 19, 2025 - 09:15 nvd

HIGH 7.2

DescriptionCVE.org

The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'outbound_resource' parameter in the slimtrack AJAX action in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored XSS in SlimStat Analytics for WordPress allows unauthenticated attackers to inject malicious scripts via unsanitized 'outbound_resource' parameter in slimtrack AJAX action (versions ≤5.3.2). Injected scripts execute when any user accesses the compromised page, enabling session hijacking, credential theft, or privilege escalation. Affects all installations with publicly accessible AJAX endpoints. No public exploit identified at time of analysis.

Technical ContextAI

Insufficient input sanitization in slimtrack AJAX handler allows raw user input from 'outbound_resource' to persist in database without encoding. CWE-79 violation occurs where stored payloads render unescaped in admin/view/right-now.php:273 and wp-slimstat-reports.php:1341. CVSS vector PR:N confirms unauthenticated exploitation surface via WordPress AJAX infrastructure.

Affected ProductsAI

SlimStat Analytics (wp-slimstat) plugin for WordPress by Slimstat, versions 5.3.2 and earlier. CPE: cpe:2.3:a:wp-slimstat:slimstat_analytics:*:*:*:*:*:wordpress:*:* (versions up to 5.3.2 inclusive). All WordPress installations with vulnerable plugin versions enabled.

RemediationAI

Upstream fix available (changeset 3421814); released patched version not independently confirmed. Per Wordfence advisory, sanitization and output escaping logic implemented to neutralize XSS vectors in slimtrack handler. Review changeset at https://plugins.trac.wordpress.org/changeset/3421814/wp-slimstat/trunk?contextall=1&old=3401545&old_path=%2Fwp-slimstat%2Ftrunk#file4 and update plugin immediately when version post-5.3.2 becomes available via WordPress repository. Temporary workaround: disable or remove SlimStat Analytics plugin until patch deployment, or restrict wp-admin/admin-ajax.php access to authenticated users only via web application firewall rules. Audit existing database records for injected JavaScript payloads. Consult full technical details at https://www.wordfence.com/threat-intel/vulnerabilities/id/6ee675dd-5b43-439f-9717-6c531e9bf066?source=cve for additional context.