CVE-2026-12592
SlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry Header
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
The SlimStat Analytics WordPress plugin before 5.5.0 does not escape a visitor-controlled geolocation value before outputting it in its admin analytics reports, allowing unauthenticated visitors to store a cross-site scripting payload that executes in the browser of an administrator who views the reports. Exploitation requires the SlimStat Analytics WordPress plugin before 5.5.0 to be configured to use the Cloudflare geolocation provider.
| Vendor | unknown |
| Product | slimstat analytics |
| Published | Jul 20, 2026 |
| Last Updated | Jul 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown slimstat analytics
Be the first to know when new high vulnerabilities affecting unknown slimstat analytics are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / SlimStat Analytics
0 < 5.5.0
References
Credits
Yaswanth Reddy Sunkara WPScan