CVE-2026-7634: SlimStat Analytics Stored XSS Vulnerability in WordPress Plugin

Technical summary

CVE-2026-7634 is a Stored XSS vulnerability (CWE-79) in the SlimStat Analytics WordPress plugin caused by insufficient input sanitization on the User-Agent HTTP header and inadequate output escaping when rendering tooltip data. An unauthenticated attacker can inject arbitrary HTML and JavaScript through normal HTTP requests containing a crafted User-Agent header. The vulnerability requires that the show_complete_user_agent_tooltip administrator setting be explicitly enabled (it is disabled by default) for the payload to render and execute. Once stored, the malicious script executes in the context of the victim's browser with the privileges of the authenticated WordPress user, potentially leading to session hijacking, credential theft, or malware distribution.

Business impact

This vulnerability poses a significant risk to WordPress sites relying on SlimStat Analytics for traffic monitoring. Because the XSS payload is stored and executes for all users who view the affected data, the blast radius can be large—especially if site administrators regularly review analytics dashboards. Compromised sessions could allow attackers to modify site content, steal sensitive data, or further compromise the WordPress installation. Organizations using this plugin should treat this as a high-priority item, particularly if the show_complete_user_agent_tooltip setting is enabled in their configurations.

Affected systems

WordPress installations with the SlimStat Analytics plugin installed and active, versions 5.4.11 and earlier. The vulnerability only manifests if the 'show_complete_user_agent_tooltip' setting has been explicitly enabled by a site administrator (this setting is disabled by default, which partially mitigates risk for unmodified installations). Any user with access to pages that display User-Agent tooltip data is at risk of executing the malicious payload.

Exploitability

Exploitation is relatively straightforward from a technical perspective: an attacker can craft HTTP requests with malicious User-Agent headers and does not require authentication or user interaction beyond the victim accessing an affected page. The attack vector is network-based and requires no elevated privileges. However, practical exploitation depends on the administrator having enabled the show_complete_user_agent_tooltip setting, which is not the default configuration. This requirement acts as a partial control, but should not be relied upon as the primary mitigation since administrators may enable this feature without fully understanding the security implications.

Remediation

Update the SlimStat Analytics plugin to a patched version released after 5.4.11. Verify the latest version against the official WordPress plugin repository or the vendor advisory. Additionally, disable the show_complete_user_agent_tooltip setting if it is not required for your analytics workflow. For sites unable to patch immediately, disabling the plugin or removing the setting will prevent exploitation until an update is available.

Patch guidance

Check the WordPress plugin repository or contact the SlimStat Analytics vendor for the availability of a patched version. Apply the latest security update as soon as it is released and verified. Test the patch in a staging environment to ensure compatibility with your WordPress theme and other plugins before deploying to production. Keep the plugin updated regularly going forward.

Detection guidance

Monitor web server and WordPress logs for HTTP requests containing suspicious User-Agent headers, particularly those containing HTML tags, script tags, or encoded payloads. Review SlimStat Analytics dashboard logs for unusual User-Agent entries. Use Web Application Firewalls (WAF) to block requests with potentially malicious User-Agent headers. If the show_complete_user_agent_tooltip setting is enabled, audit the tooltip output in your analytics interface for any unexplained or suspicious-looking entries. Consider searching your WordPress database for stored XSS payloads in tables related to SlimStat tracking data.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score (7.2), network-based attack vector that requires no authentication, and the potential for wide-scale impact across site users. Although the show_complete_user_agent_tooltip setting is disabled by default, many administrators may have enabled it without realizing the security risk. The stored nature of the XSS means that once injected, the payload will execute repeatedly for all visitors, making this a persistent threat rather than a one-time incident.

Risk score, explained

The CVSS 3.1 score of 7.2 (HIGH) reflects several critical factors: the attack vector is network-accessible with no authentication required (AV:N/PR:N), the attack complexity is low (AC:L), and the scope is changed, meaning the vulnerability affects resources beyond the vulnerable component (S:C). While confidentiality and integrity impacts are rated as low (C:L/I:L) and availability is not impacted (A:N), the combination of ease of exploitation and cross-site scope elevates this to HIGH severity. In a real-world context, the actual impact could be higher if the attacker leverages the XSS to steal session tokens or inject persistent backdoors.

Frequently asked questions