SlimStat Analytics EUVD-2026-45881

The SlimStat Analytics plugin (below 5.5.0) must be explicitly configured to use the Cloudflare geolocation provider - this is the exact feature setting that exposes the visitor-controlled geolocation value; without it the injection sink is not reached. Exploitation is further limited by required user interaction (UI:R): a logged-in administrator must view the affected analytics report for the stored payload to fire. The payload can be planted without authentication (PR:N), but the Cloudflare-provider requirement is non-default and the admin-view dependency means the attacker cannot trigger execution on demand, meaningfully narrowing real-world exploitability.

The supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.5) captures the key dynamics: network-reachable and unauthenticated to plant the payload (PR:N), but gated by high complexity (AC:H) because the site must be configured with the Cloudflare geolocation provider, and by required user interaction (UI:R) because a logged-in administrator must view the report. The C:H/I:H/A:H impact rating is generous for reflected page script but is defensible for admin-context XSS, which can hijack the session and drive full-site actions; availability impact is weak in practice. No SSVC, EPSS, or KEV data was provided in the input, so automatability and exploitation-probability signals cannot be quantified - this should be treated as unknown rather than low. A public PoC from WPScan raises practical risk above a theoretical XSS, but the non-default Cloudflare-provider prerequisite plus the need to lure an admin makes this a targeted rather than mass-exploitable issue. Net: a real, patch-worthy priority for sites matching the configuration, not a drop-everything internet-wide emergency.

An unauthenticated attacker sends a request to a target WordPress site running SlimStat with the Cloudflare geolocation provider, embedding a JavaScript payload in the visitor-controlled geolocation value so it is stored in the tracking data. When an administrator later opens the SlimStat analytics report in wp-admin, the payload executes in their authenticated session, letting the attacker perform admin actions such as creating a new admin user or planting a backdoor. A public PoC exists per WPScan, lowering the skill needed to reproduce it.