wp-slimstat vulnerabilities

Products

• slimstat analytics 11

Latest wp-slimstat CVEs

Newest publication first

1. CVE-2024-9548 Slimstat Analytics <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting

   Published 2024-10-14

   Medium·CVSS 6.1 EPSS 0.54%

   The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the resource parameter in all versions up to, and including, 5.2.6 due to insufficient input sanitization and output escaping when logging visitor requests. This makes it possible for una...

2. CVE-2024-1073 SlimStat Analytics <= 5.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting

   Published 2024-02-02

   Medium·CVSS 5.4 EPSS 0.45%

   The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filter_array' parameter in all versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

3. CVE-2022-45373 WordPress Slimstat Analytics Plugin <= 5.0.4 is vulnerable to SQL Injection

   Published 2023-11-06

   Critical·CVSS 9.8 EPSS 0.52%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jason Crouse, VeronaLabs Slimstat Analytics allows SQL Injection.This issue affects Slimstat Analytics: from n/a through 5.0.4.

4. CVE-2023-4598 Slimstat Analytics <= 5.0.9 - Authenticated (Contributor+) Blind SQL Injection via Shortcode

   Published 2023-10-20

   Medium·CVSS 6.5 EPSS 1.1%

   The Slimstat Analytics plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 5.0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it po...

5. CVE-2023-40676 WordPress Slimstat Analytics Plugin <= 5.0.8 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-09-27

   Medium·CVSS 4.8 EPSS 0.42%

   Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jason Crouse, VeronaLabs Slimstat Analytics plugin <= 5.0.8 versions.

6. CVE-2023-4597 Slimstat Analytics <= 5.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

   Published 2023-08-30

   Medium·CVSS 5.4 EPSS 0.67%

   The Slimstat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slimstat' shortcode in versions up to, and including, 5.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authent...

7. CVE-2022-45366 WordPress Slimstat Analytics Plugin <= 5.0.4 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-05-25

   Medium·CVSS 6.1 EPSS 0.41%

   Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Jason Crouse, VeronaLabs Slimstat Analytics plugin <= 5.0.4 versions.

8. CVE-2023-0630 Slimstat Analytics < 4.9.3.3 - Subscriber+ SQL Injection

   Published 2023-03-20

   High·CVSS 8.8 EPSS 5.1%

   The Slimstat Analytics WordPress plugin before 4.9.3.3 does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL query.

9. CVE-2022-4310 Slimstat Analytics < 4.9.3 - Unauthenticated Stored XSS

   Published 2023-01-09

   Medium·CVSS 6.1 EPSS 0.67%

   The Slimstat Analytics WordPress plugin before 4.9.3 does not sanitise and escape the URI when logging requests, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against logged in admin viewing the logs

10. CVE-2019-15112 WP Slimstat <= 4.8 - Unauthenticated Stored Cross-Site Scripting from Visitors

    Published 2019-08-21

    Medium·CVSS 6.1 EPSS 1.0%

    The wp-slimstat plugin before 4.8.1 for WordPress has XSS.

11. CVE-2015-9273 Slimstat Analytics < 4.1.6.1 - Cross-Site Scripting

    Published 2018-10-07

    Medium·CVSS 6.1 EPSS 1.3%

    The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-based Referer tracking.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.