CVE-2026-27410

MediumCVSS 6.5

Published: 17/06/2026(UTC)Updated: 26/10/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

20th percentile - higher than 20% of all known CVEs

Summary

In Slimstat Analytics versions below 5.4.0, there is a vulnerability to unauthenticated deserialization of untrusted data.

Risk Assessment

An attacker could exploit this vulnerability to inject malicious code, potentially leading to system compromise.

Recommendation

It is recommended to update Slimstat Analytics to version 5.4.0 or later to mitigate this vulnerability.

Other vulnerabilities in Slimstat Analytics

CVE-2026-12592High
The SlimStat Analytics WordPress plugin before version 5.5.0 does not escape a visitor-controlled geolocation value before outputting it in admin analytics reports. This allows unauthenticated visitors to store a cross-site scripting payload that executes in the browser of an administrator viewing the reports. Exploitation requires the plugin to be configured with the Cloudflare geolocation provider.

Original NVD description (English source)

Unauthenticated Deserialization of untrusted data in Slimstat Analytics < 5.4.0 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS