CVE-2024-1073

2024-02-0205:15:09

Google

osv.dev

slimstat analytics

wordpress

cross-site scripting

input sanitization

output escaping

vulnerability

web scripts

5.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.9%

JSON

The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘filter_array’ parameter in all versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CPENameOperatorVersion
wp-slimstateq5.0.6
wp-slimstateq5.0.7
wp-slimstateq5.0.8
wp-slimstateq4.8.7.1
wp-slimstateq4.9.0.1
wp-slimstateq5.0.3
wp-slimstateq4.9.4
wp-slimstateq5.1.1
wp-slimstateq4.8.1
wp-slimstateq5.1.3

Name	Operator	Version
wp-slimstat	eq	5.0.6
wp-slimstat	eq	5.0.7
wp-slimstat	eq	5.0.8
wp-slimstat	eq	4.8.7.1
wp-slimstat	eq	4.9.0.1
wp-slimstat	eq	5.0.3
wp-slimstat	eq	4.9.4
wp-slimstat	eq	5.1.1
wp-slimstat	eq	4.8.1
wp-slimstat	eq	5.1.3