PT-2025-52436 · WordPress · Slimstat Analytics

Supakiad S · Published 2025-12-19 · Updated 2025-12-19 · CVE-2025-14151

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SlimStat Analytics plugin for WordPress versions prior to 5.3.3

Description The SlimStat Analytics plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is caused by inadequate input sanitization and output escaping of user-provided attributes. An unauthenticated attacker can inject arbitrary web scripts via the outbound resource parameter in the 'slimtrack' AJAX action. When a user accesses an injected page, the malicious script will execute.

Recommendations Update the SlimStat Analytics plugin to version 5.3.3 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-14151

Affected Products

Slimstat Analytics

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-14151 · Security Note
• https://plugins.trac.wordpress.org/browser/wp-slimstat/tags/5.3.2/admin/view/right-now.php#L273 · Note
• https://t.me/cveNotify/146309 · Telegram Post
• https://t.me/CVEtracker/40262 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wp-slimstat/tags/5.3.2/admin/view/wp-slimstat-reports.php#L1341 · Note
• https://twitter.com/VulmonFeeds/status/2001959135990940133 · Twitter Post
• https://twitter.com/CVEnew/status/2002099167175594085 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/6ee675dd-5b43-439f-9717-6c531e9bf066?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3421814/wp-slimstat/trunk?contextall=1&old=3401545&old_path=%2Fwp-slimstat%2Ftrunk#file4 · Note