PT-2026-44203 · Veronalabs+1 · Slimstat Analytics+1

Supakiad S · Published 2026-05-28 · Updated 2026-05-28 · CVE-2026-7634

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SlimStat Analytics versions prior to 5.4.12

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS) via the User-Agent header. This enables the injection of arbitrary web scripts into pages that execute when a user accesses them. This issue requires the show complete user agent tooltip setting to be explicitly enabled by an administrator to render and execute the stored payload.

Recommendations Update SlimStat Analytics to version 5.4.12 or later. Disable the show complete user agent tooltip setting to prevent the execution of stored payloads.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-7634

Affected Products

Slimstat Analytics

Wp Slimstat

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7634.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-7634 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7634 · Security Note
• https://github.com/wp-slimstat/wp-slimstat/pull/297 · Note
• https://plugins.trac.wordpress.org/browser/wp-slimstat/tags/5.4.11/admin/view/wp-slimstat-reports.php#L2099 · Note
• https://plugins.trac.wordpress.org/browser/wp-slimstat/tags/5.4.4/src/Services/Browscap.php#L270 · Note
• https://plugins.trac.wordpress.org/browser/wp-slimstat/tags/5.4.11/src/Services/Browscap.php#L270 · Note
• https://plugins.trac.wordpress.org/browser/wp-slimstat/tags/5.4.4/src/Tracker/Storage.php#L25 · Note
• https://plugins.trac.wordpress.org/browser/wp-slimstat/tags/5.4.11/src/Tracker/Processor.php#L776 · Note
• https://plugins.trac.wordpress.org/browser/wp-slimstat/trunk/src/Tracker/Storage.php#L25 · Note
• https://plugins.trac.wordpress.org/browser/wp-slimstat/tags/5.4.4/src/Tracker/Processor.php#L776 · Note
• https://plugins.trac.wordpress.org/browser/wp-slimstat/tags/5.4.4/admin/view/wp-slimstat-reports.php#L2099 · Note
• https://plugins.trac.wordpress.org/browser/wp-slimstat/trunk/admin/view/wp-slimstat-reports.php#L2099 · Note
• https://plugins.trac.wordpress.org/browser/wp-slimstat/trunk/src/Services/Browscap.php#L270 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/0a309bf8-7fe3-4033-993c-3c8dba0f216d?source=cve · Note