Wp Slimstat

wp-slimstat

11 CVEs • 1 product

Products (1)

Click to collapse

Toggle

Slimstat Analytics

slimstat_analytics

CVEs (11)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-9548 1Wp Slimstat 1Slimstat Analytics Jun 17, 2026 Oct 15, 2024 N/A· v4 6.1 MEDIUM· v3 N/A· v2 The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the resource parameter in all versions up to, and including, 5.2.6 due to insufficient input sanitization and output escaping w...Show more The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the resource parameter in all versions up to, and including, 5.2.6 due to insufficient input sanitization and output escaping when logging visitor requests. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.Show less
CVE-2024-1073 1Wp Slimstat 1Slimstat Analytics Jun 17, 2026 Feb 2, 2024 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filter_array' parameter in all versions up to, and including, 5.1.3 due to insufficient input sanitization and output esca...Show more The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filter_array' parameter in all versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.Show less
CVE-2022-45373 1Wp Slimstat 1Slimstat Analytics Jun 17, 2026 Nov 6, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jason Crouse, VeronaLabs Slimstat Analytics allows SQL Injection.This issue affects Slimstat Analytics: from n/a throu...Show more Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jason Crouse, VeronaLabs Slimstat Analytics allows SQL Injection.This issue affects Slimstat Analytics: from n/a through 5.0.4.Show less
CVE-2023-4598 1Wp Slimstat 1Slimstat Analytics Jun 17, 2026 Oct 20, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 The Slimstat Analytics plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 5.0.9 due to insufficient escaping on the user supplied parameter and lack of suffic...Show more The Slimstat Analytics plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 5.0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.Show less
CVE-2023-40676 1Wp Slimstat 1Slimstat Analytics Jun 17, 2026 Sep 27, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jason Crouse, VeronaLabs Slimstat Analytics plugin <= 5.0.8 versions.
CVE-2023-4597 1Wp Slimstat 1Slimstat Analytics Jun 17, 2026 Aug 30, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The Slimstat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slimstat' shortcode in versions up to, and including, 5.0.9 due to insufficient input sanitization and output escaping on...Show more The Slimstat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slimstat' shortcode in versions up to, and including, 5.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.Show less
CVE-2022-45366 1Wp Slimstat 1Slimstat Analytics Jun 17, 2026 May 25, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Jason Crouse, VeronaLabs Slimstat Analytics plugin <= 5.0.4 versions.
CVE-2023-0630 1Wp Slimstat 1Slimstat Analytics Jun 17, 2026 Mar 20, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 The Slimstat Analytics WordPress plugin before 4.9.3.3 does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL query.
CVE-2022-4310 1Wp Slimstat 1Slimstat Analytics Jun 17, 2026 Jan 9, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 The Slimstat Analytics WordPress plugin before 4.9.3 does not sanitise and escape the URI when logging requests, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against logged i...Show more The Slimstat Analytics WordPress plugin before 4.9.3 does not sanitise and escape the URI when logging requests, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against logged in admin viewing the logsShow less
CVE-2019-15112 1Wp Slimstat 1Slimstat Analytics Jun 17, 2026 Aug 21, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The wp-slimstat plugin before 4.8.1 for WordPress has XSS.
CVE-2015-9273 1Wp Slimstat 1Slimstat Analytics Nov 21, 2024 Oct 7, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-based Referer tracking.