Stored Cross-Site Scripting in Slimstat Analytics Plugin for WordPress
CVE-2023-4599
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 30 August 2023
What is CVE-2023-4599?
The Slimstat Analytics plugin for WordPress is impacted by a Stored Cross-Site Scripting vulnerability through the 'eeb_mailto' shortcode in versions up to and including 2.1.7. This vulnerability arises from inadequate input sanitization and output escaping for user-supplied attributes, allowing authenticated attackers with contributor-level permissions or higher to inject malicious web scripts. These injected scripts can execute whenever a user accesses a compromised page, potentially leading to unauthorized actions or data exposure.
Affected Version(s)
Email Encoder – Protect Email Addresses and Phone Numbers * <= 2.1.7