The SlimStat Analytics plugin for WordPress contains a stored cross‑site scripting flaw that stems from insufficient input sanitization on the `fh` (fingerprint) parameter. When a malicious value is supplied via this parameter, it is saved into the database without escaping. Consequently, any time an administrator opens the Real‑time Access Log report the script is rendered and executed, potentially enabling the attacker to steal session cookies, perform unauthorized actions, or deface the site. The core weakness is reflected in CWE‑79.

The flaw exists in all official releases of the SlimStat Analytics plugin up to and including version 5.3.3. Users of these or earlier versions are vulnerable; the vulnerability does not affect versions 5.3.4 and later, where input validation has been added.

The vulnerability has a CVSS base score of 7.2, indicating high impact. The EPSS score is less than 1 %, suggesting it is not widely exploited in the wild so far. The flaw is not listed in CISA’s KEV catalog. The likely attack vector is an unauthenticated web request that injects a malicious `fh` value; this request can be crafted by an external attacker or a compromised user who can write to the database via the plugin’s interface. Once the payload is stored, any administrator who views the report will trigger execution of the injected script.