Junglewise Threat Intelligence

CVE-2026-7634: SlimStat Analytics Stored XSS via User-Agent header

CVE-2026-7634 · Severity: high · CVSS 7.2 · Published 2026-05-28

Executive brief

SlimStat Analytics, a popular WordPress plugin used for tracking website visitor statistics, contains a security flaw that allows unauthenticated attackers to inject malicious scripts into the website's database. These scripts are triggered when an administrator views specific analytics reports, potentially allowing the attacker to hijack administrative sessions or perform unauthorized actions. The risk is highest for sites that have manually enabled the 'show_complete_user_agent_tooltip' setting.

Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in SlimStat Analytics due to insufficient input sanitization and output escaping of the 'User-Agent' HTTP header. An unauthenticated attacker can send a crafted request with a malicious payload in the User-Agent header, which is then stored in the plugin's database. The vulnerability is triggered when an administrator views the analytics reports, provided the 'show_complete_user_agent_tooltip' setting is enabled (it is disabled by default). The fix, introduced in version 5.4.12, implements a three-layer defense: sanitizing the header during capture in Browscap.php, sanitizing during database updates in Storage.php, and using wp_kses_post() to defang HTML in the admin report view.

Affected products

  • wp-slimstat SlimStat Analytics Up to and including 5.4.11

Timeline

  • 2026-05-11: patched: Version 5.4.12 released to address the vulnerability.
  • 2026-05-28: disclosed: Public disclosure and CVE assignment.

References

Related threats