Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.2

WordPress SlimStat Analytics can run malicious scripts

CVE-2026-7634 · published 5 months ago
Summary

The SlimStat Analytics plugin for WordPress allows anyone to place harmful code in the site by sending a crafted User-Agent header. The code is stored and runs when a visitor views a page, but only if the admin has turned on the show_complete_user_agent_tooltip option. Update the plugin to the latest version or keep that setting turned off to prevent the issue.

Original advisory text
SlimStat Analytics <= 5.4.11 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header
The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'User-Agent' header in all versions up to, and including, 5.4.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The show_complete_user_agent_tooltip setting must be explicitly enabled by an administrator (disabled by default) for the stored payload to be rendered and executed.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.2 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published28 May 2026
Updated4 Nov 2026
First seen28 May 2026
Sources
CVE-2026-7634 · NVD
CVE-2026-7634 · OSV
Track software like this
Free during beta