PT-2026-1767 · WordPress · Slimstat Analytics

Supakiad S · Published 2026-01-09 · Updated 2026-01-09 · CVE-2025-15057

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SlimStat Analytics plugin for WordPress versions through 5.3.3

Description The SlimStat Analytics plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. The issue resides in the fh (fingerprint) parameter, allowing unauthenticated attackers to inject arbitrary web scripts into the database. These scripts execute when an administrator views the Real-time Access Log report. The vulnerable parameter is fh.

Recommendations Update the SlimStat Analytics plugin to a version newer than 5.3.3.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-15057

Affected Products

Slimstat Analytics

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-15057 · Security Note
• https://plugins.trac.wordpress.org/changeset/3428488/wp-slimstat · Note
• https://twitter.com/CVEnew/status/2009526571082678732 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/90920df9-1362-466b-b14b-4714087f556b?source=cve · Note