WordPress plugin
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 28 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High15
- Medium13
- Low0
All SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce vulnerabilities
- High7.2Unauthenticated Stored Cross-Site Scripting
≤5.4.0Update to 5.5.0
- Medium6.5Authenticated (Subscriber+) SQL Injection
≤5.4.11Update to 5.4.12
- High8.1Unauthenticated PHP Object Injection
<5.4.0Update to 5.4.0
- High7.2Unauthenticated Stored Cross-Site Scripting via User-Agent Header
≤5.4.11Update to 5.4.12
- High7.2Unauthenticated Stored Cross-Site Scripting via 'fh'
≤5.3.5Update to 5.4.0
- Medium6.5Authenticated (Subscriber+) SQL Injection via `args` Parameter
≤5.3.1Update to 5.3.2
- Medium6.1Reflected Cross-Site Scripting
≤5.3.2Update to 5.3.3
- High7.2Unauthenticated Stored Cross-Site Scripting via 'fh' Parameter
≤5.3.3Update to 5.3.4
- High7.2Unauthenticated Stored Cross-Site Scripting via 'notes/resource' Parameters
≤5.3.4Update to 5.3.5
- High7.2Unauthenticated Stored Cross-Site Scripting
≤5.3.2Update to 5.3.3
- High7.2Unauthenticated Stored Cross-Site Scripting
≤5.2.6Update to 5.2.7
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤5.1.3Update to 5.1.4
- High8.8Authenticated (Contributor+) Blind SQL Injection via Shortcode
≤5.0.9Update to 5.0.10
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤5.0.9Update to 5.0.10
- Medium4.3Missing Authorization via delete_pageview
≤5.0.5.1Update to 5.0.6
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via settings
≤5.0.8Update to 5.0.9
- High7.2Authenticated (Administrator+) SQL Injection
≤5.0.4Update to 5.0.5
- Medium6.1Reflected Cross-Site Scripting
≤5.0.4Update to 5.0.5
- High8.8Authenticated (Subscriber+) SQL Injection via Shortcode
≤4.9.3.3Update to 4.9.3.4
- High8.8Authenticated (Subscriber+) SQL Injection via Shortcode
≤4.9.3.2Update to 4.9.3.3
- High7.2Unauthenticated Stored Cross-Site Scripting
≤4.9.2Update to 4.9.3
- Medium6.1Reflected Cross-Site Scripting via REQUEST_URI
≤4.9.2Update to 4.9.3
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
<4.8.4Update to 4.8.4
- Medium6.1Unauthenticated Stored Cross-Site Scripting from Visitors
≤4.8Update to 4.8.1
- Medium6.1Cross-Site Scripting
<4.1.6.1Update to 4.1.6.1
- High8.2Unauthenticated Blind SQL Injection
<3.9.6Update to 3.9.6
- Medium6.1Stored Cross-Site Scripting
<3.5.6Update to 3.5.6
- Medium6.1Cross-Site Scripting
<3.9.3Update to 3.9.3
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce: common questions
Does SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce have known vulnerabilities?
Yes. VulnCrest Radar lists 28 known vulnerabilities in SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce: 15 high, 13 medium. None are known to affect version null.
How do I check which version of SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce vulnerability?
CVE-2026-12592, published Jun 29, 2026: SlimStat Analytics <= 5.4.0 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).
Is any SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce vulnerability listed in CISA KEV?
No. None of the known SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce vulnerabilities is currently listed in the CISA KEV catalog.