CVE-2025-15057

Name of the Vulnerable Software and Affected Versions SlimStat Analytics plugin for WordPress versions through 5.3.3

Description The SlimStat Analytics plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. The issue resides in the fh (fingerprint) parameter, allowing unauthenticated attackers to inject arbitrary web scripts into the database. These scripts execute when an administrator views the Real-time Access Log report. The vulnerable parameter is fh.

Recommendations Update the SlimStat Analytics plugin to a version newer than 5.3.3.