VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 24 known issues Latest disclosed Mar 18, 2026

SlimStat Analytics Vulnerabilities

Review known vulnerability records for the WordPress plugin SlimStat Analytics (`wp-slimstat`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2026-1238, CVE-2025-13431 and CVE-2025-69323, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
24
High or Critical
12
Patch Coverage
100%
Last Updated
Mar 19, 2026
Related Security Guides

Use these guides while reviewing SlimStat Analytics fixes

Pair this plugin vulnerability hub with practical WordPress hardening, scanner, and patch workflow guidance.

Hardening
WordPress hardening checklist for exposed plugins

Review patch cadence, privileged access, XML-RPC exposure, backups, and monitoring controls.
Plugin Security
WordPress plugin security basics for patch decisions

Use ownership, update testing, least privilege, and removal criteria to reduce plugin risk.
Scanning
WordPress vulnerability scanner buyer's guide

Compare scanner coverage for plugin CVEs, version detection, alert noise, and remediation workflow.
Patch Decision Workflow

How to prioritize SlimStat Analytics remediation

Use the hub as a decision layer before opening individual records: confirm whether the issue has a CVE, whether a fixed version exists, and whether the affected range overlaps production installs.

Search-Ready Records
21
1. Match the Package
Confirm the installed WordPress plugin slug is wp-slimstat before acting on any CVE from this cluster.
2. Sort by Severity
Start with 12 high or critical records, then review medium and unrated findings with public references.
3. Check Patch Evidence
24 records include a patch path; verify compatibility before closing the finding.
4. Monitor Gaps
0 records still lack a listed fixed release, so keep this hub in the review queue.
High-Signal Remediation Targets
CVE-2023-4598 High
SQL Injection remediation for SlimStat Analytics

Affected range: Versions up to 5.0.9. Fixed version: 5.0.10.

CVE-2023-0630 High
SQL Injection remediation for SlimStat Analytics

Affected range: Versions up to 4.9.3.2. Fixed version: 4.9.3.3.

CVE-2026-1238 High
Stored Cross-Site Scripting remediation for SlimStat Analytics

Affected range: Versions up to 5.3.5. Fixed version: 5.4.0.

CVE-2025-15057 High
Stored Cross-Site Scripting remediation for SlimStat Analytics

Affected range: Versions up to 5.3.3. Fixed version: 5.3.4.

Priority CVE Quick Links

Fast paths into SlimStat Analytics CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
20
Tracked CVE Issue Type Affected Versions Fixed Version CVSS
CVE-2023-4598
Slimstat Analytics <= 5.0.9 - Authenticated (Contributor+) Blind SQL Injection via S...
 SQL Injection Versions up to 5.0.9 5.0.10 CVSS 8.8
CVE-2023-0630
Slimstat Analytics <= 4.9.3.2 - Authenticated (Subscriber+) SQL Injection via Shortc...
 SQL Injection Versions up to 4.9.3.2 4.9.3.3 CVSS 8.8
CVE-2026-1238
SlimStat Analytics <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via 'fh'
 Stored Cross-Site Scripting Versions up to 5.3.5 5.4.0 CVSS 7.2
CVE-2025-15057
SlimStat Analytics <= 5.3.3 - Unauthenticated Stored Cross-Site Scripting via 'fh' P...
 Stored Cross-Site Scripting Versions up to 5.3.3 5.3.4 CVSS 7.2
CVE-2025-15055
SlimStat Analytics <= 5.3.4 - Unauthenticated Stored Cross-Site Scripting via 'notes...
 Stored Cross-Site Scripting Versions up to 5.3.4 5.3.5 CVSS 7.2
CVE-2025-14151
SlimStat Analytics <= 5.3.2 - Unauthenticated Stored Cross-Site Scripting
 Stored Cross-Site Scripting Versions up to 5.3.2 5.3.3 CVSS 7.2
CVE-2024-9548
Slimstat Analytics <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting
 Stored Cross-Site Scripting Versions up to 5.2.6 5.2.7 CVSS 7.2
CVE-2022-45373
Slimstat Analytics <= 5.0.4 - Authenticated (Administrator+) SQL Injection
 SQL Injection Versions up to 5.0.4 5.0.5 CVSS 7.2
CVE-2023-4598 High 5.0.10
CVE-2023-4598 SlimStat Analytics SQL Injection

Slimstat Analytics <= 5.0.9 - Authenticated (Contributor+) Blind SQL Injection via Shortcode

CVE-2023-0630 High 4.9.3.3
CVE-2023-0630 SlimStat Analytics SQL Injection

Slimstat Analytics <= 4.9.3.2 - Authenticated (Subscriber+) SQL Injection via Shortcode

CVE-2026-1238 High 5.4.0
CVE-2026-1238 SlimStat Analytics Stored Cross-Site Scripting

SlimStat Analytics <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via 'fh'

CVE-2025-15057 High 5.3.4
CVE-2025-15057 SlimStat Analytics Stored Cross-Site Scripting

SlimStat Analytics <= 5.3.3 - Unauthenticated Stored Cross-Site Scripting via 'fh' Parameter

CVE-2025-15055 High 5.3.5
CVE-2025-15055 SlimStat Analytics Stored Cross-Site Scripting

SlimStat Analytics <= 5.3.4 - Unauthenticated Stored Cross-Site Scripting via 'notes/resource' Parameters

CVE-2025-14151 High 5.3.3
CVE-2025-14151 SlimStat Analytics Stored Cross-Site Scripting

SlimStat Analytics <= 5.3.2 - Unauthenticated Stored Cross-Site Scripting

CVE-2024-9548 High 5.2.7
CVE-2024-9548 SlimStat Analytics Stored Cross-Site Scripting

Slimstat Analytics <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting

CVE-2022-45373 High 5.0.5
CVE-2022-45373 SlimStat Analytics SQL Injection

Slimstat Analytics <= 5.0.4 - Authenticated (Administrator+) SQL Injection

Coverage Snapshot

What this page helps you verify fast

This hub clusters tracked records for SlimStat Analytics so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
24 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
0 critical and 12 high severity findings.
Recent CVEs
CVE-2026-1238, CVE-2025-13431 and CVE-2025-69323
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for SlimStat Analytics

Sorted by latest disclosure date so newly published issues surface first.

Plugin High Patched: Yes CVE-2026-1238
CVE-2026-1238: SlimStat Analytics <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via 'fh'

The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fh' (fingerprint) parameter in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

Published
Mar 18, 2026
Patched Release
5.4.0
Affected Versions
Versions up to 5.3.5
Next Step
Update to 5.4.0 or newer if supported.
Review CVE-2026-1238 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-13431
CVE-2025-13431: SlimStat Analytics <= 5.3.1 - Authenticated (Subscriber+) SQL Injection via `args` Parameter

The SlimStat Analytics plugin for WordPress is vulnerable to time-based SQL Injection via the ‘args’ parameter in all versions up to, and including, 5.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi...

Published
Feb 10, 2026
Patched Release
5.3.2
Affected Versions
Versions up to 5.3.1
Next Step
Update to 5.3.2 or newer if supported.
Review CVE-2025-13431 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-69323
CVE-2025-69323: Slimstat Analytics <= 5.3.2 - Reflected Cross-Site Scripting

The Slimstat Analytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 5.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

Published
Jan 27, 2026
Patched Release
5.3.3
Affected Versions
Versions up to 5.3.2
Next Step
Update to 5.3.3 or newer if supported.
Review CVE-2025-69323 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2025-15057
CVE-2025-15057: SlimStat Analytics <= 5.3.3 - Unauthenticated Stored Cross-Site Scripting via 'fh' Parameter

The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `fh` (fingerprint) parameter in all versions up to, and including, 5.3.3. This is due to insufficient input sanitization and output escaping on the fingerprint value stored in the dat...

Published
Jan 08, 2026
Patched Release
5.3.4
Affected Versions
Versions up to 5.3.3
Next Step
Update to 5.3.4 or newer if supported.
Review CVE-2025-15057 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2025-15055
CVE-2025-15055: SlimStat Analytics <= 5.3.4 - Unauthenticated Stored Cross-Site Scripting via 'notes/resource' Parameters

The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' and 'resource' parameters in all versions up to, and including, 5.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated at...

Published
Jan 08, 2026
Patched Release
5.3.5
Affected Versions
Versions up to 5.3.4
Next Step
Update to 5.3.5 or newer if supported.
Review CVE-2025-15055 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2025-14151
CVE-2025-14151: SlimStat Analytics <= 5.3.2 - Unauthenticated Stored Cross-Site Scripting

The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'outbound_resource' parameter in the slimtrack AJAX action in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping on user supp...

Published
Dec 18, 2025
Patched Release
5.3.3
Affected Versions
Versions up to 5.3.2
Next Step
Update to 5.3.3 or newer if supported.
Review CVE-2025-14151 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2024-9548
CVE-2024-9548: Slimstat Analytics <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting

The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the resource parameter in all versions up to, and including, 5.2.6 due to insufficient input sanitization and output escaping when logging visitor requests. This makes it possible for una...

Published
Oct 14, 2024
Patched Release
5.2.7
Affected Versions
Versions up to 5.2.6
Next Step
Update to 5.2.7 or newer if supported.
Review CVE-2024-9548 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-1073
CVE-2024-1073: SlimStat Analytics <= 5.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting

The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filter_array' parameter in all versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

Published
Feb 01, 2024
Patched Release
5.1.4
Affected Versions
Versions up to 5.1.3
Next Step
Update to 5.1.4 or newer if supported.
Review CVE-2024-1073 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2023-4598
CVE-2023-4598: Slimstat Analytics <= 5.0.9 - Authenticated (Contributor+) Blind SQL Injection via Shortcode

The Slimstat Analytics plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 5.0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it po...

Published
Sep 11, 2023
Patched Release
5.0.10
Affected Versions
Versions up to 5.0.9
Next Step
Update to 5.0.10 or newer if supported.
Review CVE-2023-4598 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-4597
CVE-2023-4597: Slimstat Analytics <= 5.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Slimstat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slimstat' shortcode in versions up to, and including, 5.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authent...

Published
Aug 28, 2023
Patched Release
5.0.10
Affected Versions
Versions up to 5.0.9
Next Step
Update to 5.0.10 or newer if supported.
Review CVE-2023-4597 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-40676
CVE-2023-40676: Slimstat Analytics <= 5.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings

The Slimstat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 5.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-l...

Published
Aug 22, 2023
Patched Release
5.0.9
Affected Versions
Versions up to 5.0.8
Next Step
Update to 5.0.9 or newer if supported.
Review CVE-2023-40676 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-33994
CVE-2023-33994: Slimstat Analytics <= 5.0.5.1 - Missing Authorization via delete_pageview

The Slimstat Analytics plugin for WordPress is vulnerable to unauthorized PageView Deletion due to a missing capability check on the delete_pageview function in versions up to, and including, 5.0.5.1. This makes it possible for authenticated attackers, with subscriber-level acces...

Published
Aug 22, 2023
Patched Release
5.0.6
Affected Versions
Versions up to 5.0.5.1
Next Step
Update to 5.0.6 or newer if supported.
Review CVE-2023-33994 fixed version details Open CVE Reference