Plataforma
wordpress
Componente
wp-slimstat
Corrigido em
5.3.6
CVE-2026-1238 describes a stored Cross-Site Scripting (XSS) vulnerability discovered in the SlimStat Analytics WordPress plugin. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts, potentially compromising user sessions and website functionality. The vulnerability affects versions from 0.0.0 up to and including 5.3.5, and a fix is available in version 5.4.0.
Successful exploitation of CVE-2026-1238 allows an attacker to inject malicious JavaScript code into pages served by the SlimStat Analytics plugin. When a user visits a page containing the injected script, the script executes in the user's browser context, allowing the attacker to steal cookies, redirect the user to a malicious website, or deface the website. The impact can range from minor annoyance to complete account takeover, depending on the attacker's goals and the privileges of the affected user. This vulnerability is particularly concerning because it does not require authentication, meaning any visitor to the website could potentially exploit it.
CVE-2026-1238 was publicly disclosed on 2026-03-19. No known public exploits or active campaigns targeting this vulnerability have been reported as of this writing. The vulnerability is not currently listed on the CISA KEV catalog. The ease of exploitation, combined with the widespread use of WordPress plugins, suggests that this vulnerability could become a target for opportunistic attackers.
Websites using the SlimStat Analytics plugin, particularly those running older versions (0.0.0–5.3.5), are at risk. Shared hosting environments where plugin updates are managed by the hosting provider are also at increased risk, as users may not have direct control over plugin versions.
• wordpress / composer / npm:
grep -r 'fh=.*;' /var/www/html/wp-content/plugins/slimstat-analytics/*• generic web:
curl -I 'https://your-wordpress-site.com/?fh=<script>alert(1)</script>' | grep 'Content-Type:'• wordpress / composer / npm:
wp plugin list --status=active | grep slimstat-analyticsdisclosure
Status do Exploit
EPSS
0.09% (percentil 25%)
CISA SSVC
Vetor CVSS
The primary mitigation for CVE-2026-1238 is to upgrade the SlimStat Analytics plugin to version 5.4.0 or later, which contains the necessary fix. If immediate upgrading is not possible, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious input in the 'fh' parameter. Additionally, carefully review any user input processed by the plugin and ensure proper sanitization and output escaping to prevent future XSS vulnerabilities. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload via the 'fh' parameter and verifying that it is not executed.
Atualize para a versão 5.4.0, ou uma versão corrigida mais recente
Análise de vulnerabilidades e alertas críticos diretamente no seu e-mail.
CVE-2026-1238 is a stored Cross-Site Scripting (XSS) vulnerability in the SlimStat Analytics WordPress plugin, allowing attackers to inject malicious scripts via the 'fh' parameter.
You are affected if you are using SlimStat Analytics WordPress plugin versions 0.0.0 through 5.3.5. Upgrade to 5.4.0 or later to mitigate the risk.
Upgrade the SlimStat Analytics plugin to version 5.4.0 or later. Consider a WAF rule to block suspicious input in the 'fh' parameter as a temporary workaround.
As of now, there are no reports of active exploitation campaigns targeting CVE-2026-1238, but the vulnerability's ease of exploitation warrants caution.
Refer to the SlimStat Analytics plugin documentation and website for the official advisory and update information.
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.