Platform
wordpress
Component
wp-slimstat
Fixed in
5.3.6
CVE-2026-1238 describes a stored Cross-Site Scripting (XSS) vulnerability discovered in the SlimStat Analytics WordPress plugin. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts, potentially compromising user sessions and website functionality. The vulnerability affects versions from 0.0.0 up to and including 5.3.5, and a fix is available in version 5.4.0.
Successful exploitation of CVE-2026-1238 allows an attacker to inject malicious JavaScript code into pages served by the SlimStat Analytics plugin. When a user visits a page containing the injected script, the script executes in the user's browser context, allowing the attacker to steal cookies, redirect the user to a malicious website, or deface the website. The impact can range from minor annoyance to complete account takeover, depending on the attacker's goals and the privileges of the affected user. This vulnerability is particularly concerning because it does not require authentication, meaning any visitor to the website could potentially exploit it.
CVE-2026-1238 was publicly disclosed on 2026-03-19. No known public exploits or active campaigns targeting this vulnerability have been reported as of this writing. The vulnerability is not currently listed on the CISA KEV catalog. The ease of exploitation, combined with the widespread use of WordPress plugins, suggests that this vulnerability could become a target for opportunistic attackers.
Exploit Status
EPSS
0.09% (25% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-1238 is to upgrade the SlimStat Analytics plugin to version 5.4.0 or later, which contains the necessary fix. If immediate upgrading is not possible, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious input in the 'fh' parameter. Additionally, carefully review any user input processed by the plugin and ensure proper sanitization and output escaping to prevent future XSS vulnerabilities. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload via the 'fh' parameter and verifying that it is not executed.
Update to version 5.4.0, or a newer patched version
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-1238 is a stored Cross-Site Scripting (XSS) vulnerability in the SlimStat Analytics WordPress plugin, allowing attackers to inject malicious scripts via the 'fh' parameter.
You are affected if you are using SlimStat Analytics WordPress plugin versions 0.0.0 through 5.3.5. Upgrade to 5.4.0 or later to mitigate the risk.
Upgrade the SlimStat Analytics plugin to version 5.4.0 or later. Consider a WAF rule to block suspicious input in the 'fh' parameter as a temporary workaround.
As of now, there are no reports of active exploitation campaigns targeting CVE-2026-1238, but the vulnerability's ease of exploitation warrants caution.
Refer to the SlimStat Analytics plugin documentation and website for the official advisory and update information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.