CVE-2025-15055

Name of the Vulnerable Software and Affected Versions SlimStat Analytics plugin for WordPress versions prior to 5.3.5

Description The SlimStat Analytics plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to inadequate input sanitization and output escaping in the 'notes' and 'resource' parameters. An unauthenticated attacker can inject arbitrary web scripts that execute when an administrator views the Recent Custom Events report. The vulnerable parameters are notes and resource.

Recommendations Update the SlimStat Analytics plugin to version 5.3.5 or later.