PT-2026-61524 · WordPress · Slimstat Analytics

CVE-2026-12592 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SlimStat Analytics WordPress plugin versions prior to 5.5.0

Description Stored cross-site scripting occurs when the plugin fails to escape a visitor-controlled geolocation value before outputting it in admin analytics reports. This allows unauthenticated visitors to store a malicious payload that executes in the browser of an administrator viewing the reports. This issue specifically affects installations configured to use the Cloudflare geolocation provider.

Recommendations Update SlimStat Analytics WordPress plugin to version 5.5.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-12592

Affected Products

Slimstat Analytics

References · 3

• 🔥 https://wpscan.com/vulnerability/3658cae6-f6ae-4ecc-8d74-bb402e61f5d5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-12592 · Security Note
• https://twitter.com/VulmonFeeds/status/2079140668539052491 · Twitter Post