CVE-2026-12592

HighCVSS 7.5

Published: 20/07/2026(UTC)Updated: 20/07/2026(UTC)Translated: 21/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

11th percentile - higher than 11% of all known CVEs

Summary

The SlimStat Analytics WordPress plugin before version 5.5.0 does not escape a visitor-controlled geolocation value before outputting it in admin analytics reports. This allows unauthenticated visitors to store a cross-site scripting payload that executes in the browser of an administrator viewing the reports. Exploitation requires the plugin to be configured with the Cloudflare geolocation provider.

Risk Assessment

An attacker can hijack an administrator session, steal sensitive data, or modify WordPress site settings, leading to full site compromise.

Recommendation

Immediately update the SlimStat Analytics plugin to version 5.5.0 or later. If updating is not possible, temporarily disable the Cloudflare geolocation provider in the plugin settings.

Other vulnerabilities in SlimStat Analytics

CVE-2026-27410Medium
In Slimstat Analytics versions below 5.4.0, there is a vulnerability to unauthenticated deserialization of untrusted data.

Original NVD description (English source)

The SlimStat Analytics WordPress plugin before 5.5.0 does not escape a visitor-controlled geolocation value before outputting it in its admin analytics reports, allowing unauthenticated visitors to store a cross-site scripting payload that executes in the browser of an administrator who views the reports. Exploitation requires the SlimStat Analytics WordPress plugin before 5.5.0 to be configured to use the Cloudflare geolocation provider.