Slimstat Analytics CVE-2026-1238

SlimStat Analytics plugin versions up to 5.3.5 for WordPress must be installed and active. Unauthenticated attacker injects malicious script via 'fh' (fingerprint) parameter. Victim must visit the page containing injected payload for script execution.

The CVSS v3.1 score of 7.2 reflects a significant risk with network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and changed scope (S:C), indicating the attacker can compromise resources beyond the vulnerable component. However, the real-world risk should be contextualized: while unauthenticated attackers can inject payloads, exploitation requires victims (typically site administrators) to view the analytics dashboard where the stored XSS executes. The changed scope indicates potential for lateral movement beyond the plugin itself. Without confirmed EPSS data, KEV listing, or public POC availability, this appears to be a moderate priority vulnerability that requires attention but may not demand emergency patching unless the affected WordPress site has high administrator activity in the analytics interface. The primary concern is that attackers can inject malicious scripts without authentication, but actual impact depends on administrative access patterns and session privileges when the payload executes.

An unauthenticated attacker crafts a malicious request to a WordPress site running SlimStat Analytics, injecting JavaScript code into the 'fh' fingerprint parameter during normal visitor tracking. When a site administrator later accesses the analytics dashboard to review visitor statistics, the stored malicious script executes in their browser session with their administrative privileges, potentially allowing the attacker to create new admin accounts, install backdoor plugins, or steal session cookies. The low attack complexity and lack of required user interaction (beyond normal administrative activity) make this vulnerability readily exploitable by remote attackers with no special access.