CyberRota Analysis
AI-GeneratedThe SlimStat Analytics WordPress plugin prior to version 5.5.0 is vulnerable due to improper escaping of user-controlled geolocation values, enabling unauthenticated visitors to inject cross-site scripting (XSS) payloads. This vulnerability poses a significant risk as it can lead to the execution of malicious scripts in the browser of an administrator viewing the analytics reports. WordPress site administrators using this plugin, particularly those configured with the Cloudflare geolocation provider, should prioritize immediate updates to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The SlimStat Analytics WordPress plugin before 5.5.0 does not escape a visitor-controlled geolocation value before outputting it in its admin analytics reports, allowing unauthenticated visitors to store a cross-site scripting payload that executes in the browser of an administrator who views the reports. Exploitation requires the SlimStat Analytics WordPress plugin before 5.5.0 to be configured to use the Cloudflare geolocation provider.