The SlimStat Analytics plugin for WordPress is susceptible to Stored Cross-Site Scripting, which allows unauthenticated attackers to execute arbitrary scripts within the administrative dashboard.

This vulnerability is a Stored Cross-Site Scripting (CWE-79) flaw caused by insufficient input sanitization and output escaping within the 'notes' and 'resource' parameters. The attack vector is network-based and requires no authentication, allowing malicious scripts to execute when an administrator views the Recent Custom Events report.

The exploitation of this vulnerability could lead to unauthorized actions performed on behalf of an administrator, potentially resulting in full site compromise or data theft. Given the CVSS score of 7.2, this is classified as a High severity issue, as it allows unauthenticated attackers to manipulate the administrative session and access sensitive reporting data.

Immediate Action: Update the SlimStat Analytics plugin to the latest version, which includes the necessary input sanitization fixes. If an update is not immediately available, disable or remove the plugin until a secure version is deployed.

Proactive Monitoring: Review administrative audit logs for any unexpected changes to site settings or unusual activity originating from the Recent Custom Events report area.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious script injection patterns in HTTP requests targeting the affected plugin parameters.

Public Exploit Available: No confirmed public exploit (Metasploit or ExploitDB) is currently available for this vulnerability.

This vulnerability presents a significant risk to WordPress installations due to the ease of exploitation by unauthenticated actors. Administrators should prioritize updating the SlimStat Analytics plugin immediately to ensure that input sanitization is correctly implemented, thereby preventing potential administrative account takeover or unauthorized data access.