Plugin icon

SlimStat Analytics

wp-slimstat

Vulnerabilities:

23

Last Updated:

March 8, 2026

Active Installs:

80000

Published
Title
Fixed in
CVSS
Published
2026-02-10
Title
SlimStat Analytics < 5.3.2 - Authenticated (Subscriber+) SQL Injection via `args` Parameter
Fixed in
Fixed in 5.3.2
CVSS
6.5 (medium)
Published
2026-01-27
Title
Slimstat Analytics < 5.3.3 - Reflected Cross-Site Scripting
Fixed in
Fixed in 5.3.3
CVSS
6.1 (medium)
Published
2026-01-08
Title
SlimStat Analytics < 5.3.4 - Unauthenticated Stored Cross-Site Scripting via 'fh' Parameter
Fixed in
Fixed in 5.3.4
CVSS
7.2 (high)
Published
2026-01-08
Title
SlimStat Analytics < 5.3.5 - Unauthenticated Stored Cross-Site Scripting via 'notes/resource' Parameters
Fixed in
Fixed in 5.3.5
CVSS
7.2 (high)
Published
2025-12-18
Title
SlimStat Analytics < 5.3.3 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 5.3.3
CVSS
7.2 (high)
Published
2024-10-14
Title
Slimstat Analytics < 5.2.7 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 5.2.7
CVSS
7.2 (high)
Published
2024-02-01
Title
SlimStat Analytics < 5.1.4 - Subscriber+ Stored XSS
Fixed in
Fixed in 5.1.4
CVSS
8.0 (high)
Published
2023-09-11
Title
Slimstat Analytics < 5.0.10 - Contributor+ SQL Injection
Fixed in
Fixed in 5.0.10
CVSS
6.8 (medium)
Published
2023-08-29
Title
Slimstat Analytics < 5.0.9 - Admin+ Stored XSS
Fixed in
Fixed in 5.0.9
CVSS
3.5 (low)
Published
2023-08-28
Title
Slimstat Analytics < 5.0.10 - Contributor+ Stored XSS
Fixed in
Fixed in 5.0.10
CVSS
5.9 (medium)
Published
2023-05-11
Title
Slimstat Analytics < 5.0.5 - Admin+ SQLi
Fixed in
Fixed in 5.0.5
CVSS
4.1 (medium)
Published
2023-05-11
Title
Slimstat Analytics < 5.0.5 - Reflected XSS
Fixed in
Fixed in 5.0.5
CVSS
7.1 (high)
Published
2023-04-05
Title
Slimstat Analytics < 4.9.4 - Subscriber+ SQL Injection
Fixed in
Fixed in 4.9.4
CVSS
7.7 (high)
Published
2023-02-27
Title
Slimstat Analytics < 4.9.3.3 - Subscriber+ SQL Injection
Fixed in
Fixed in 4.9.3.3
CVSS
7.7 (high)
Published
2022-12-19
Title
Slimstat Analytics < 4.9.3 - Unauthenticated Stored XSS
Fixed in
Fixed in 4.9.3
CVSS
8.8 (high)
Published
2019-07-08
Title
WP Slimstat <= 4.8.3 - CSRF to Stored XSS and Setting Updates
Fixed in
Fixed in 4.8.4
CVSS
n/a
Published
2019-05-21
Title
WP Slimstat <= 4.8 - Unauthenticated Stored XSS from Visitors
Fixed in
Fixed in 4.8.1
CVSS
6.1 (medium)
Published
2017-03-07
Title
WP SlimStat <= 3.5.5 - Overview URI Stored XSS
Fixed in
Fixed in 3.5.6
CVSS
n/a
Published
2015-07-26
Title
WP Slimstat < 4.1.6 - Referer Header Cross-Site Scripting (XSS)
Fixed in
Fixed in 4.1.6
CVSS
6.1 (medium)
Published
2015-02-24
Title
WP Slimstat <= 3.9.5 - Weak Cryptographic Keys Leading to SQL Injections
Fixed in
Fixed in 3.9.6
CVSS
n/a
Published
2015-01-25
Title
WP SlimStat <= 3.9.2 - Stored Cross-Site Scripting (XSS)
Fixed in
Fixed in 3.9.3
CVSS
n/a
Published
2015-01-06
Title
WP SlimStat <= 3.9.1 - Cross-Site Scripting (XSS)
Fixed in
Fixed in 3.9.2
CVSS
n/a
Published
2014-08-01
Title
WP SlimStat 2.8.4 - wp-content/plugins/wp-slimstat/admin/view/panel1.php s Parameter XSS
Fixed in
Fixed in 2.8.5
CVSS
n/a