The SlimStat Analytics plugin for WordPress contains an insufficient input sanitization and output escaping flaw on the "outbound_resource" parameter in the slimtrack AJAX action. This deficiency allows an unauthenticated attacker to store malicious JavaScript code that is later rendered when any user views an affected page. The result is an unvalidated cross‑site scripting (XSS) vulnerability that can be leveraged to hijack sessions, steal credentials, deface content, or perform other malicious actions that compromise the confidentiality and integrity of user data. The flaw is purely a stored XSS, not a remote code execution vulnerability.

The vulnerability affects all instances of the SlimStat Analytics plugin provided by veronalabs whose version is 5.3.2 or earlier. Users operating any earlier releases are exposed unless they have applied a patch or removed the plugin.

With a CVSS score of 7.2 and an EPSS score below 1%, the risk is considered high but the likelihood of exploitation is low. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely via unauthenticated access to administrative pages where the "outbound_resource" value can be submitted and stored. Exploitation requires no special privileges; any web user with access to the site's search or report pages could trigger the script.