A critical Stored Cross-Site Scripting vulnerability in the SlimStat Analytics plugin for WordPress allows unauthenticated attackers to execute arbitrary web scripts within the administrative interface.

This vulnerability occurs due to insufficient input sanitization and output escaping of the fingerprint parameter. An unauthenticated attacker can inject malicious JavaScript that executes when an administrator views the Real-time Access Log report.

The ability to execute arbitrary scripts in the context of an administrator session poses a significant risk to organizational integrity. Successful exploitation could lead to account takeover, unauthorized administrative actions, or the theft of sensitive session data, justifying the high CVSS score of 7.2.

Immediate Action: Update the SlimStat Analytics plugin to version 5.3.4 or higher immediately to resolve the input sanitization flaw.

Proactive Monitoring: Review administrative access logs for suspicious activity or unauthorized script execution patterns within the WordPress dashboard.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious script injection attempts targeting the fh parameter until the patch is applied.

Public Exploit Available: Unknown

Given the potential for unauthorized administrative access, organizations utilizing the SlimStat Analytics plugin must prioritize this update. Failure to remediate this vulnerability leaves the WordPress management interface exposed to malicious script injection, which could facilitate broader compromise of the application environment.