Vulnerability details
CVE-2026-12592
SlimStat Analytics
SlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry Header
CVSS 3.1
7.5High
Official description
The SlimStat Analytics WordPress plugin before 5.5.0 does not escape a visitor-controlled geolocation value before outputting it in its admin analytics reports, allowing unauthenticated visitors to store a cross-site scripting payload that executes in the browser of an administrator who views the reports. Exploitation requires the SlimStat Analytics WordPress plugin before 5.5.0 to be configured to use the Cloudflare geolocation provider.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| — | SlimStat Analytics | v < 5.5.0 | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://wpscan.com/vulnerability/3658cae6-f6ae-4ecc-8d74-bb402e61f5d5/ exploitvdb-entrytechnical-description
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-07-20
- Last updated
- 2026-07-20
- State
- Published
- Assigner (CNA)
- WPScan
Exploit prediction (EPSS)
0.35%
Probability of exploitation in 30 days
29%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Proof of concept
- Technical impact
- Total
Weaknesses (CWE)
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')