CVE-2026-12592

HIGH

SlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry Header

Title source: cna
STIX 2.1

Description

The SlimStat Analytics WordPress plugin before 5.5.0 does not escape a visitor-controlled geolocation value before outputting it in its admin analytics reports, allowing unauthenticated visitors to store a cross-site scripting payload that executes in the browser of an administrator who views the reports. Exploitation requires the SlimStat Analytics WordPress plugin before 5.5.0 to be configured to use the Cloudflare geolocation provider.

References (1)

Core 1
Core References
Exploit exploit vdb-entry technical-description
https://wpscan.com/vulnerability/3658cae6-f6ae-4ecc-8d74-bb402e61f5d5/

Scores

CVSS v3 7.5
EPSS 0.0020
EPSS Percentile 10.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-79
Status published
Products (1)
None/SlimStat Analytics < 5.5.0
Published Jul 20, 2026
Tracked Since Jul 20, 2026