Stored Cross-Site Scripting Vulnerability in SlimStat Analytics Plugin for WordPress

CVE-2024-1073

What is CVE-2024-1073?

The SlimStat Analytics plugin for WordPress exhibits a vulnerability that allows authenticated users with subscriber-level access or higher to engage in Stored Cross-Site Scripting through the 'filter_array' parameter. This risk stems from inadequate input sanitization and output escaping, enabling attackers to inject malicious scripts into pages. Consequently, these scripts are executed in the browser of any user who accesses the compromised page, posing serious security threats.

References