CVE-2026-7634

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-7634

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7634.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-7634

Published

2026-05-28T06:45:38.395Z

Modified

2026-08-12T03:51:41.773952209Z

Severity

7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator

Summary

SlimStat Analytics <= 5.4.11 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header

Details

The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'User-Agent' header in all versions up to, and including, 5.4.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The showcompleteuseragenttooltip setting must be explicitly enabled by an administrator (disabled by default) for the stored payload to be rendered and executed.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7634.json",
    "cna_assigner": "Wordfence",
    "cwe_ids": [
        "CWE-79"
    ]
}

References

Affected packages

Git / github.com/wp-slimstat/wp-slimstat

Affected ranges

Type

GIT

Repo

https://github.com/wp-slimstat/wp-slimstat

Events

Introduced

Last affected

3eb274503fef455f31918979a050faf383810ac4

Database specific

Show details

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "5.4.11"
        }
    ]
}

Affected versions

4.*

4.8.1

4.8.2

4.8.3

4.9

4.9.0.1

5.*

5.4.0

v4.*

v4.9.2

v4.9.3

v4.9.3.1

v4.9.3.2

v4.9.3.3

v4.9.4

v5.*

v5.0

v5.0.1

v5.0.10

v5.0.10.1

v5.0.10.2

v5.0.2

v5.0.3

v5.0.4

v5.0.5

v5.0.5.1

v5.0.6

v5.0.7

v5.0.8

v5.0.9

v5.1

v5.1.1

v5.1.2

v5.1.3

v5.1.4

v5.1.5

v5.2

v5.2.1

v5.2.10

v5.2.11

v5.2.12

v5.2.13

v5.2.2

v5.2.3

v5.2.4

v5.2.5

v5.2.6

v5.2.7

v5.2.8

v5.2.9

v5.3.0

v5.3.1

v5.3.2

v5.3.3

v5.3.4

v5.3.5

v5.4.1

v5.4.11

v5.4.2

v5.4.3

v5.4.4

v5.4.5

v5.4.6

v5.4.8

v5.4.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7634.json"