What is the CVSS score of CVE-2026-1238?

CVE-2026-1238 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-1238?

WordPress sites using SlimStat Analytics plugin (versions up to 5.3.5) are vulnerable to stored cross-site scripting attacks that could allow attackers to inject malicious code affecting all site…

How to fix or mitigate CVE-2026-1238?

Within 24 hours: Identify all WordPress instances running SlimStat Analytics and document affected versions; disable the plugin if not business-critical or restrict access to trusted users only. Within 7 days: Implement WAF rules to filter malicious payloads in the 'fh' parameter; consider migrating to alternative analytics solutions. Within 30 days: Monitor vendor announcements for patch availability; conduct security audit of injected content if exploitation is suspected; establish plugin inventory and update management process.

WordPress CVE-2026-1238

EUVD-2026-13043 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-19 Wordfence

WordPress XSS

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 19, 2026 - 05:00 euvd

EUVD-2026-13043

Analysis Generated

Mar 19, 2026 - 05:00 vuln.today

CVE Published

Mar 19, 2026 - 04:27 nvd

HIGH 7.2

DescriptionCVE.org

The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fh' (fingerprint) parameter in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

The SlimStat Analytics plugin for WordPress contains a Stored Cross-Site Scripting vulnerability in the 'fh' (fingerprint) parameter that allows unauthenticated attackers to inject malicious scripts into pages. All versions up to and including 5.3.5 are affected due to insufficient input sanitization and output escaping. The vulnerability has a CVSS score of 7.2 with network-based attack vector requiring no privileges or user interaction, though no active exploitation (KEV) or EPSS data is currently reported.

Technical ContextAI

This vulnerability affects the SlimStat Analytics plugin (CPE: cpe:2.3:a:veronalabs:slimstat_analytics) for WordPress, specifically in the handling of the 'fh' fingerprint parameter used for visitor tracking. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where user-supplied data is stored without proper sanitization and later rendered without adequate output escaping. The vulnerable code can be observed in the admin/view/right-now.php file at line 185 and wp-slimstat.php at line 1948 in version 5.3.5, where the fingerprint parameter is processed and displayed without sufficient security controls. This is a classic Stored XSS vulnerability where malicious payloads persist in the application's data store and execute when administrators or users view the affected analytics pages.

RemediationAI

Upgrade the SlimStat Analytics plugin to version 5.3.6 or later, which addresses this vulnerability as indicated by the patch changeset at https://plugins.trac.wordpress.org/changeset/3477417/. Site administrators should update through the WordPress plugin dashboard or manually replace the plugin files. Until patching is completed, consider temporarily disabling the SlimStat Analytics plugin if it is not critical to operations, or restrict access to the WordPress admin dashboard to trusted IP addresses only via web server configuration or security plugins. Review analytics data for suspicious fingerprint entries that may contain script tags or JavaScript code, and implement Content Security Policy headers to mitigate XSS impact. Refer to the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/e991fbdf-8e26-4d2e-8e3b-c8990914dcad for additional mitigation guidance.