What is the CVSS score of CVE-2026-7634?

CVE-2026-7634 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of SlimStat Analytics are affected by CVE-2026-7634?

SlimStat Analytics, a WordPress analytics plugin with significant market adoption, contains a stored cross-site scripting vulnerability allowing attackers to inject malicious code via User-Agent…

How to fix or mitigate CVE-2026-7634?

Within 24 hours: Disable the 'show_complete_user_agent_tooltip' setting in SlimStat Analytics settings, or deactivate the plugin entirely pending a vendor patch. Within 7 days: Check the SlimStat Analytics plugin repository for security updates addressing versions through 5.4.11; document the vulnerability in your plugin inventory and establish monitoring for patch release announcements. Within 30 days: If no patch has been released, evaluate switching to an alternative analytics solution with better security practices, or implement Web Application Firewall (WAF) rules to block suspicious User-Agent headers containing script patterns.

SlimStat Analytics CVE-2026-7634

EUVD-2026-32729 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-28 Wordfence

GHSA-xvg3-935w-4mv9

XSS WordPress

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 28, 2026 - 07:51 vuln.today

Analysis Generated

May 28, 2026 - 07:51 vuln.today

CVE Published

May 28, 2026 - 06:45 nvd

HIGH 7.2

DescriptionCVE.org

The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'User-Agent' header in all versions up to, and including, 5.4.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The show_complete_user_agent_tooltip setting must be explicitly enabled by an administrator (disabled by default) for the stored payload to be rendered and executed.

AnalysisAI

Stored cross-site scripting in the SlimStat Analytics WordPress plugin (versions through 5.4.11) allows unauthenticated attackers to inject arbitrary JavaScript via the User-Agent request header, which is persisted unsanitized and later rendered inside the admin Browsers report tooltip. Exploitation requires the non-default 'show_complete_user_agent_tooltip' setting to be enabled by an administrator, after which any admin viewing the affected report executes the attacker's script. No public exploit identified at time of analysis and no EPSS or CISA KEV signal is provided in the supplied data.

Technical ContextAI

SlimStat Analytics is a self-hosted visitor analytics plugin for WordPress maintained by VeronaLabs (CPE cpe:2.3:a:veronalabs:slimstat_analytics). The plugin captures visitor metadata including the HTTP User-Agent header in Browscap::_get_user_agent() and persists it via the Tracker storage layer. Per the 5.4.12 fix, Storage::insertRow() already applied sanitize_text_field()/sanitize_url() on initial insertion, but Storage::updateRow() - invoked on redirect handling (Processor::updateContentType) and AJAX follow-up branches (Ajax::process navigation/outbound/event) - overwrote the row with the raw header, defeating the initial sanitization. The stored value was then concatenated into an admin tooltip span in wp_slimstat_reports::inline_help() (admin/view/wp-slimstat-reports.php line 2099) without output escaping, yielding a CWE-79 stored XSS that fires in the privileged WordPress admin context.

RemediationAI

Vendor-released patch: upgrade SlimStat Analytics to version 5.4.12 (released 2026-05-13), which sanitizes the User-Agent at capture in Browscap::_get_user_agent(), mirrors insertRow()'s sanitize_text_field()/sanitize_url() handling inside Storage::updateRow(), and defangs admin tooltip output via wp_kses_post() in wp_slimstat_reports::inline_help() - see https://github.com/wp-slimstat/wp-slimstat/pull/297 and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/0a309bf8-7fe3-4033-993c-3c8dba0f216d. If immediate patching is not possible, the most effective workaround is to ensure the 'show_complete_user_agent_tooltip' option remains disabled (its default state), which prevents rendering of the stored payload at the cost of losing the full User-Agent tooltip in the Browsers report. As an additional compensating control, place the WordPress site behind a WAF rule that strips or rejects HTML/script-bearing User-Agent headers (trade-off: may break legitimate but unusual UAs and analytics fidelity), and audit the wp_slimstat database tables for previously stored payloads containing '<script', 'onerror=', or javascript: before re-enabling the tooltip.