What is the CVSS score of CVE-2026-12592?

CVE-2026-12592 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of SlimStat Analytics are affected by CVE-2026-12592?

SlimStat Analytics for WordPress contains a stored cross-site scripting vulnerability allowing unauthenticated attackers to compromise administrator accounts when Cloudflare geolocation is enabled.. A patch is available.

Is there a public PoC exploit available for CVE-2026-12592?

Yes, a public proof-of-concept exploit is available for CVE-2026-12592. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-12592?

Within 24 hours, identify all WordPress instances using SlimStat Analytics plugin and verify whether Cloudflare geolocation provider is configured in plugin settings. Within 7 days, update SlimStat Analytics to version 5.5.0 or later on all affected instances, applying the vendor-released patch immediately. Within 30 days, validate successful patch deployment across all WordPress installations and consider disabling the Cloudflare geolocation provider if not operationally critical.

SlimStat Analytics CVE-2026-12592

EUVD-2026-45881 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-20 WPScan

GHSA-m3j2-94qc-pfvg

WordPress XSS Slimstat Analytics Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Unauthenticated storage (PR:N) but AC:H for the required Cloudflare-provider config and UI:R for admin view; script crosses into the admin browser authority (S:C) enabling session/account compromise, with no real availability impact (A:N).

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 14:24 vuln.today

CVSS changed

Jul 20, 2026 - 14:22 NVD

7.5 (HIGH)

Patch available

Jul 20, 2026 - 09:17 EUVD

CVE Published

Jul 20, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 20, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The SlimStat Analytics WordPress plugin before 5.5.0 does not escape a visitor-controlled geolocation value before outputting it in its admin analytics reports, allowing unauthenticated visitors to store a cross-site scripting payload that executes in the browser of an administrator who views the reports. Exploitation requires the SlimStat Analytics WordPress plugin before 5.5.0 to be configured to use the Cloudflare geolocation provider.

Articles & Coverage 1

News 6 New WordPress Vulnerabilities - 1 Critical, 5 High, All With POC Jul 21, 2026

AnalysisAI

Stored cross-site scripting in the SlimStat Analytics WordPress plugin before 5.5.0 lets unauthenticated visitors inject a persistent payload through a geolocation value that fires when an administrator opens the analytics reports, enabling admin-session compromise. The flaw is only reachable when the plugin is configured to use the Cloudflare geolocation provider. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available; no public exploit identified as actively exploited and it is not in CISA KEV.

Technical ContextAI

SlimStat Analytics is a self-hosted visitor-tracking plugin for WordPress that records and displays per-visitor metadata, including geolocation, in wp-admin reporting screens. When the Cloudflare geolocation provider is enabled, the plugin trusts a visitor-controlled geolocation value (derived from request data Cloudflare passes through) and writes it to the tracking datastore, then renders it into the admin analytics report without output encoding. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) stored/persistent XSS: attacker-influenced data crosses a trust boundary from an anonymous request into a privileged admin HTML context, so the script executes with the administrator's authenticated session. The CPE cpe:2.3:a:unknown:slimstat_analytics covers all versions below 5.5.0.

RemediationAI

Upgrade the SlimStat Analytics plugin to version 5.5.0 or later, which is the vendor-released patch that adds output escaping for the geolocation value. If immediate patching is not possible, switch the plugin's geolocation provider away from Cloudflare to remove the exploitable code path (trade-off: loss of Cloudflare-based geolocation accuracy), or temporarily deactivate the plugin (trade-off: loss of analytics collection). As defense in depth, restrict wp-admin analytics-report access to trusted administrators and consider a WAF/CSP rule that constrains inline script execution in wp-admin, noting CSP may break other admin functionality. Reference the WPScan advisory (https://wpscan.com/vulnerability/3658cae6-f6ae-4ecc-8d74-bb402e61f5d5/) for confirmation of the fixed version.