CVE-2025-14151

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14151", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-05T19:42:06.501Z", "datePublished": "2025-12-19T08:23:40.685Z", "dateUpdated": "2026-04-15T13:50:48.795Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:59:49.869Z"}, "affected": [{"vendor": "veronalabs", "product": "SlimStat Analytics", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.3.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'outbound_resource' parameter in the slimtrack AJAX action in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "SlimStat Analytics <= 5.3.2 - Unauthenticated Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6ee675dd-5b43-439f-9717-6c531e9bf066?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-slimstat/tags/5.3.2/admin/view/wp-slimstat-reports.php#L1341"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-slimstat/tags/5.3.2/admin/view/right-now.php#L273"}, {"url": "https://plugins.trac.wordpress.org/changeset/3421814/wp-slimstat/trunk?contextall=1&old=3401545&old_path=%2Fwp-slimstat%2Ftrunk#file4"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Supakiad S."}], "timeline": [{"time": "2025-12-05T20:02:26.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-18T20:00:46.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-15T13:50:43.935596Z", "id": "CVE-2025-14151", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T13:50:48.795Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14151", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T13:50:43.935596Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-19T15:23:33.311Z"}}], "cna": {"title": "SlimStat Analytics <= 5.3.2 - Unauthenticated Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Supakiad S."}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "veronalabs", "product": "SlimStat Analytics", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.3.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-05T20:02:26.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-18T20:00:46.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6ee675dd-5b43-439f-9717-6c531e9bf066?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-slimstat/tags/5.3.2/admin/view/wp-slimstat-reports.php#L1341"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-slimstat/tags/5.3.2/admin/view/right-now.php#L273"}, {"url": "https://plugins.trac.wordpress.org/changeset/3421814/wp-slimstat/trunk?contextall=1&old=3401545&old_path=%2Fwp-slimstat%2Ftrunk#file4"}], "descriptions": [{"lang": "en", "value": "The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'outbound_resource' parameter in the slimtrack AJAX action in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:59:49.869Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14151", "state": "PUBLISHED", "dateUpdated": "2026-04-15T13:50:48.795Z", "dateReserved": "2025-12-05T19:42:06.501Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-19T08:23:40.685Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SlimStat Analytics", "vendor": "veronalabs", "versions": [{"lessThanOrEqual": "5.3.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'outbound_resource' parameter in the slimtrack AJAX action in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin SlimStat Analytics para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del par\u00e1metro 'outbound_resource' en la acci\u00f3n AJAX slimtrack en todas las versiones hasta la 5.3.2, inclusive. Esto se debe a una sanitizaci\u00f3n de entrada insuficiente y a un escape de salida en los atributos proporcionados por el usuario. Esto hace posible que atacantes no autenticados inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-14151", "lastModified": "2026-09-30T23:10:00.237", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14151", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-15T13:50:43.935596Z", "version": "2.0.3"}}]}, "published": "2025-12-19T09:15:46.133", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-slimstat/tags/5.3.2/admin/view/right-now.php#L273"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-slimstat/tags/5.3.2/admin/view/wp-slimstat-reports.php#L1341"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3421814/wp-slimstat/trunk?contextall=1&old=3401545&old_path=%2Fwp-slimstat%2Ftrunk#file4"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6ee675dd-5b43-439f-9717-6c531e9bf066?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T15:59:52.992247+00:00", "value": {"mitigation_remediation": ["Upgrade SlimStat Analytics to the latest version (5.3.3 or later) once it is released.", "If an update is not yet available, temporarily disable the SlimStat Analytics plugin to eliminate the vulnerable code path.", "Apply a Web Application Firewall rule that blocks or sanitizes the \"outbound_resource\" parameter or blocks execution of injected scripts on the admin pages."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary web script execution via stored XSS"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all instances of the SlimStat Analytics plugin provided by veronalabs whose version is 5.3.2 or earlier. Users operating any earlier releases are exposed unless they have applied a patch or removed the plugin.", "description_and_impact": "The SlimStat Analytics plugin for WordPress contains an insufficient input sanitization and output escaping flaw on the \"outbound_resource\" parameter in the slimtrack AJAX action. This deficiency allows an unauthenticated attacker to store malicious JavaScript code that is later rendered when any user views an affected page. The result is an unvalidated cross\u2011site scripting (XSS) vulnerability that can be leveraged to hijack sessions, steal credentials, deface content, or perform other malicious actions that compromise the confidentiality and integrity of user data. The flaw is purely a stored XSS, not a remote code execution vulnerability.", "risk_and_exploitability": "With a CVSS score of 7.2 and an EPSS score below 1%, the risk is considered high but the likelihood of exploitation is low. The vulnerability is not listed in CISA\u2019s KEV catalog. The attack vector is likely via unauthenticated access to administrative pages where the \"outbound_resource\" value can be submitted and stored. Exploitation requires no special privileges; any web user with access to the site's search or report pages could trigger the script."}}}}, "created": "2025-12-21T21:13:11.665578+00:00", "updated": "2026-04-20T16:00:10.651147+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wp-slimstat", "wp-slimstat$PRODUCT$slimstat_analytics"]}