Key detail from CVE description: The SlimStat Analytics plugin for WordPress is vulnerable to stored cross‑site scripting via the 'fh' parameter in all versions up to 5.3.5 due to insufficient input sanitization and output escaping. Attackers who can supply arbitrary values for 'fh' can inject malicious scripts that execute whenever an affected user views the injected page, potentially leading to session hijacking, defacement, or theft of credentials.

The affected product is the SlimStat Analytics plugin from veronalabs. All releases up to and including version 5.3.5 are susceptible; no impact was reported for newer releases in the CVE record.

The CVSS score for this vulnerability is 7.2, which corresponds to a high severity rating. The EPSS score is not provided and the vulnerability is not listed in CISA’s KEV catalog, indicating no widespread, known exploitation. According to the CVE description the attack vector is unauthenticated input of the 'fh' parameter; an attacker can embed a payload that will execute in the context of any visitor to the affected page. Because the flaw does not require authentication, it poses an elevated risk to all users of the plugin.