Improper Neutralization of Input During Web Page Generation allows an attacker to embed malicious scripts that execute in the context of the victim’s browser. The reflected XSS flaw is present in all releases of Slimstat Analytics up to and including version 5.3.2, enabling code injection that could lead to session hijacking, defacement, or data exfiltration on affected sites.

The vulnerability impacts the VeronaLabs Slimstat Analytics WordPress plugin. Any installation of the plugin with a version number from the earliest released build through 5.3.2 is susceptible. Organization owners should verify the plugin version and confirm whether it falls within the affected range.

The CVSS score of 7.1 indicates considerable risk to confidentiality and integrity, while the EPSS score of less than 1% suggests that active exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog, and no known public exploit has been reported. Likely attack vectors involve embedding crafted query parameters or form inputs that are reflected unescaped in the plugin’s output. An attacker would need access to a page that includes the plugin, but no elevated privileges are required to exploit the flaw.