EUVD-2026-45881
GHSA-m3j2-94qc-pfvg
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Unauthenticated storage (PR:N) but AC:H for the required Cloudflare-provider config and UI:R for admin view; script crosses into the admin browser authority (S:C) enabling session/account compromise, with no real availability impact (A:N).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
The SlimStat Analytics WordPress plugin before 5.5.0 does not escape a visitor-controlled geolocation value before outputting it in its admin analytics reports, allowing unauthenticated visitors to store a cross-site scripting payload that executes in the browser of an administrator who views the reports. Exploitation requires the SlimStat Analytics WordPress plugin before 5.5.0 to be configured to use the Cloudflare geolocation provider.
Articles & Coverage 1
AnalysisAI
Stored cross-site scripting in the SlimStat Analytics WordPress plugin before 5.5.0 lets unauthenticated visitors inject a persistent payload through a geolocation value that fires when an administrator opens the analytics reports, enabling admin-session compromise. The flaw is only reachable when the plugin is configured to use the Cloudflare geolocation provider. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The SlimStat Analytics plugin (below 5.5.0) must be explicitly configured to use the Cloudflare geolocation provider - this is the exact feature setting that exposes the visitor-controlled geolocation value; without it the injection sink is not reached. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.5) captures the key dynamics: network-reachable and unauthenticated to plant the payload (PR:N), but gated by high complexity (AC:H) because the site must be configured with the Cloudflare geolocation provider, and by required user interaction (UI:R) because a logged-in administrator must view the report. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends a request to a target WordPress site running SlimStat with the Cloudflare geolocation provider, embedding a JavaScript payload in the visitor-controlled geolocation value so it is stored in the tracking data. When an administrator later opens the SlimStat analytics report in wp-admin, the payload executes in their authenticated session, letting the attacker perform admin actions such as creating a new admin user or planting a backdoor. … |
| Remediation | Upgrade the SlimStat Analytics plugin to version 5.5.0 or later, which is the vendor-released patch that adds output escaping for the geolocation value. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress instances using SlimStat Analytics plugin and verify whether Cloudflare geolocation provider is configured in plugin settings. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Slimstat Analytics
View allThe Slimstat Analytics plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to,
The Slimstat Analytics WordPress plugin before 4.9.3.3 does not prevent subscribers from rendering shortcodes that conca
Blind SQL injection in VeronaLabs Slimstat Analytics WordPress plugin through version 5.4.11 allows authenticated low-pr
Unauthenticated deserialization of untrusted data in the Slimstat Analytics WordPress plugin (versions prior to 5.4.0) a
The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filter_array' paramete
The Slimstat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slimstat' shortcode in
The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the resource parameter in a
The wp-slimstat plugin before 4.8.1 for WordPress has XSS. Rated medium severity (CVSS 6.1), this vulnerability is remot
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today