CVE-2026-7634: SlimStat Analytics <= 5.4.11 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header

Synopsis

Stored cross-site scripting (XSS) in the SlimStat Analytics plugin for WordPress (versions up to and including 5.4.11) allows an unauthenticated attacker to inject malicious JavaScript via the HTTP User-Agent request header. The payload is stored in the database and executes in the browser of any user who views the affected analytics page, provided the administrator has enabled the show_complete_user_agent_tooltip setting. Successful exploitation lets an attacker run arbitrary scripts in victims' browser sessions, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker sends a crafted HTTP request with a malicious User-Agent header over the network to any WordPress site running the affected plugin, with no requirement for a pre-existing foothold on the host.

• AuthenticationNot required

  No account or credential of any privilege level is needed; any unauthenticated HTTP request to the target site is sufficient to deliver the payload.

• Victim interactionNot required

  The stored payload executes automatically in the browser of any user who loads the affected analytics page, with no additional social-engineering step required once the payload is stored.

• Attack complexityDetail

  Exploitation is reliable and condition-free from the attacker's side, though the administrator must have explicitly enabled the show_complete_user_agent_tooltip setting (disabled by default) for the stored payload to render.

Blast Radius

• An attacker's injected script runs in the browser session of any WordPress user (including administrators) who views the affected analytics page, allowing session token theft via document.cookie access.
• Stolen session tokens can be used to take over authenticated WordPress accounts, including admin accounts, without needing the account's password.
• The injected script can make authenticated requests on behalf of the victim, modifying site content, creating rogue admin users, or installing additional plugins.