Executive brief
SlimStat Analytics is a WordPress plugin used to track and report website visitor statistics. A security flaw allows unauthenticated visitors to inject malicious scripts into the plugin's database by spoofing location data. When a site administrator views the analytics dashboard, these scripts execute in their browser, potentially allowing the attacker to hijack the administrator's session or perform unauthorized actions on the website.
Technical details
The SlimStat Analytics plugin fails to sanitize or escape visitor-controlled geolocation data before storing it in the database and subsequently rendering it in administrative reports. Specifically, when the plugin is configured to use Cloudflare as its geolocation provider, it trusts the 'CF-IPCountry' HTTP header. An unauthenticated attacker can send a crafted POST request to the tracking endpoint with a malicious payload in this header. When an administrator views the 'Audience' or 'Access Log' reports, the payload is injected into the HTML attributes of image tags (e.g., 'onload' or 'onerror' handlers), leading to arbitrary JavaScript execution in the context of the administrator's session. This issue is fixed in version 5.5.0.
Affected products
- Unknown SlimStat Analytics < 5.5.0
Timeline
- 2026-06-05: other: Initial discovery or internal tracking date
- 2026-06-29: disclosed: Publicly published by WPScan
- 2026-07-20: advisory: NVD publication date