Vulnerability · Published Jul 20, 2026 · Assigned by WPScan

CVE-2026-12592SlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry Header

High 7.5

In plain English

A high-severity cross-site scripting in SlimStat Analytics from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 71.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The SlimStat Analytics WordPress plugin before 5.5.0 does not escape a visitor-controlled geolocation value before outputting it in its admin analytics reports, allowing unauthenticated visitors to store a cross-site scripting payload that executes in the browser of an administrator who views the reports. Exploitation requires the SlimStat Analytics WordPress plugin before 5.5.0 to be configured to use the Cloudflare geolocation provider.

Affected products (as reported)

Vendor	Product	Versions
Unknown	SlimStat Analytics	0 – before 5.5.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/3658cae6-f6ae-4ecc-8d74-bb402e61f5d5/ exploit, vdb-entry, technical-description