PT-2026-1766 · WordPress · Slimstat Analytics

Supakiad S · Published 2026-01-09 · Updated 2026-01-09 · CVE-2025-15055

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SlimStat Analytics plugin for WordPress versions prior to 5.3.5

Description The SlimStat Analytics plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to inadequate input sanitization and output escaping in the 'notes' and 'resource' parameters. An unauthenticated attacker can inject arbitrary web scripts that execute when an administrator views the Recent Custom Events report. The vulnerable parameters are notes and resource.

Recommendations Update the SlimStat Analytics plugin to version 5.3.5 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-15055

Affected Products

Slimstat Analytics

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-15055 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/afbfabfc-b923-4fe9-9e8f-0cf159f488db?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3429990/wp-slimstat · Note
• https://twitter.com/CVEnew/status/2009526570147328487 · Twitter Post