The SlimStat Analytics plugin for WordPress contains a Stored Cross-Site Scripting vulnerability that allows unauthenticated attackers to execute arbitrary web scripts in a victim's browser.

This is a Stored Cross-Site Scripting (CWE-79) vulnerability occurring within the 'fh' (fingerprint) parameter. The vulnerability allows unauthenticated attackers to inject malicious scripts that execute whenever a user views the compromised page.

Successful exploitation of this vulnerability can lead to session hijacking, unauthorized actions performed on behalf of an administrator, or the redirection of users to malicious websites. Given the CVSS score of 7.2, this represents a high-severity risk that could compromise the integrity of the WordPress environment and lead to significant data exposure or loss of user trust.

Immediate Action: Since a specific patch version is not currently identified in the enrichment data, administrators should immediately deactivate and remove the SlimStat Analytics plugin until a verified secure version is released by the vendor.

Proactive Monitoring: Monitor server access logs for suspicious requests targeting the 'fh' parameter or unusual traffic patterns associated with the SlimStat plugin endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious script injection attempts and sanitize input for parameters associated with the affected plugin.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

The presence of a public proof-of-concept combined with the high CVSS score necessitates immediate attention. Organizations utilizing the SlimStat Analytics plugin must prioritize deactivation to eliminate the attack surface until the vendor confirms a fix is available and successfully deployed.