SlimStat Analytics < 5.1.4 - Subscriber+ Stored XSS

2024-02-0200:00:00

wpscan.com

slimstat analytics

vulnerability

stored cross-site scripting

filter_array

input sanitization

output escaping

authenticated users

subscriber

web scripts

pages

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.4%

JSON

Description The plugin is vulnerable to Stored Cross-Site Scripting via the ‘filter_array’ parameter due to insufficient input sanitization and output escaping, allowing any authenticated users, such as subscriber, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.