The SlimStat Analytics plugin contains a critical stored XSS vulnerability that allows unauthenticated attackers to hijack administrative sessions.

This is a stored cross-site scripting (XSS) vulnerability where an unauthenticated visitor can inject malicious scripts into geolocation data, which then executes in the browser of an administrator viewing the analytics reports.

This vulnerability carries a CVSS score of 7.5, reflecting its potential for full administrative account compromise. If exploited, an attacker could gain unauthorized access to the WordPress dashboard, exfiltrate sensitive data, or modify site content, posing a severe risk to organizational security and integrity.

Immediate Action: Update the SlimStat Analytics plugin to version 5.5.0 or later to ensure proper output escaping.

Proactive Monitoring: Review administrative audit logs for unauthorized changes or suspicious activity occurring shortly after viewing analytics reports.

Compensating Controls: Utilize a Web Application Firewall with XSS protection rules to block malicious payloads from reaching the application backend.

Public Exploit Available: Yes, public proof-of-concept exploits are available.

Given the existence of public proof-of-concept code and the high potential for administrative takeover, all users of the SlimStat Analytics plugin must update to version 5.5.0 immediately. Prioritize this update to prevent potential site-wide compromise.