Aller au contenu
Se connecter
7.5 Élevée

CVE-2026-12592 The SlimStat Analytics WordPress plugin before 5.5.0 does not escape a visitor-controlled geolocation value before…

Description

The SlimStat Analytics WordPress plugin before 5.5.0 does not escape a visitor-controlled geolocation value before outputting it in its admin analytics reports, allowing unauthenticated visitors to store a cross-site scripting payload that executes in the browser of an administrator who views the reports. Exploitation requires the SlimStat Analytics WordPress plugin before 5.5.0 to be configured to use the Cloudflare geolocation provider.

Produits et versions touchés

Produit Versions touchées Corrigé en
Slimstat Analytics 5.5 premières → < 5.5.0 5.5.0

Autres CVE de Slimstat Analytics

Les 3 CVE de Slimstat Analytics →
CVE-2023-0630 The Slimstat Analytics WordPress plugin before 4.9.3.3 does not prevent subscribers from rendering shortcodes that… Non notée CVE-2022-4310 The Slimstat Analytics WordPress plugin before 4.9.3 does not sanitise and escape the URI when logging requests, which… 6.1 Moyenne
Suivre cette CVE