CVE-2025-15057

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15057", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-23T19:12:52.860Z", "datePublished": "2026-01-09T06:34:55.004Z", "dateUpdated": "2026-04-08T17:06:47.430Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:06:47.430Z"}, "affected": [{"vendor": "veronalabs", "product": "SlimStat Analytics", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.3.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `fh` (fingerprint) parameter in all versions up to, and including, 5.3.3. This is due to insufficient input sanitization and output escaping on the fingerprint value stored in the database. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator views the Real-time Access Log report."}], "title": "SlimStat Analytics <= 5.3.3 - Unauthenticated Stored Cross-Site Scripting via 'fh' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/90920df9-1362-466b-b14b-4714087f556b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3428488/wp-slimstat"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Supakiad S."}], "timeline": [{"time": "2025-12-23T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-12-23T19:29:29.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-08T18:00:57.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-09T19:07:13.782865Z", "id": "CVE-2025-15057", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-09T19:10:42.287Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-15057", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-09T19:07:13.782865Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-09T19:10:39.396Z"}}], "cna": {"title": "SlimStat Analytics <= 5.3.3 - Unauthenticated Stored Cross-Site Scripting via 'fh' Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Supakiad S."}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "veronalabs", "product": "SlimStat Analytics", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.3.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-23T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-12-23T19:29:29.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-08T18:00:57.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/90920df9-1362-466b-b14b-4714087f556b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3428488/wp-slimstat"}], "descriptions": [{"lang": "en", "value": "The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `fh` (fingerprint) parameter in all versions up to, and including, 5.3.3. This is due to insufficient input sanitization and output escaping on the fingerprint value stored in the database. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator views the Real-time Access Log report."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:06:47.430Z"}}}, "cveMetadata": {"cveId": "CVE-2025-15057", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:06:47.430Z", "dateReserved": "2025-12-23T19:12:52.860Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-09T06:34:55.004Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SlimStat Analytics", "vendor": "veronalabs", "versions": [{"lessThanOrEqual": "5.3.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `fh` (fingerprint) parameter in all versions up to, and including, 5.3.3. This is due to insufficient input sanitization and output escaping on the fingerprint value stored in the database. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator views the Real-time Access Log report."}, {"lang": "es", "value": "El plugin SlimStat Analytics para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del par\u00e1metro 'fh' (huella digital) en todas las versiones hasta la 5.3.3, inclusive. Esto se debe a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes en el valor de la huella digital almacenado en la base de datos. Esto hace posible que atacantes no autenticados inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un administrador vea el informe de Registro de Acceso en Tiempo Real."}], "id": "CVE-2025-15057", "lastModified": "2026-06-17T08:37:01.663", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15057", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-09T19:07:13.782865Z", "version": "2.0.3"}}]}, "published": "2026-01-09T07:16:02.483", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3428488/wp-slimstat"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/90920df9-1362-466b-b14b-4714087f556b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T16:33:35.304579+00:00", "value": {"mitigation_remediation": ["Upgrade the SlimStat Analytics plugin to version 5.3.4 or later, which includes proper input validation for the fh parameter", "If an upgrade is not immediately possible, temporarily disable the Real\u2011time Access Log feature or set the plugin to no\u2011log mode to prevent the script from being displayed", "Implement a web application firewall rule to block or sanitize attempts to inject scripts via the fh parameter before they reach the plugin"], "summary": {"action": "Patch Immediately", "impact": "Stored Cross\u2011Site Scripting in the SlimStat Analytics plugin allows arbitrary script execution under an administrator\u2019s session"}, "threat_synthesis": {"affected_systems": "The flaw exists in all official releases of the SlimStat Analytics plugin up to and including version 5.3.3. Users of these or earlier versions are vulnerable; the vulnerability does not affect versions 5.3.4 and later, where input validation has been added.", "description_and_impact": "The SlimStat Analytics plugin for WordPress contains a stored cross\u2011site scripting flaw that stems from insufficient input sanitization on the `fh` (fingerprint) parameter. When a malicious value is supplied via this parameter, it is saved into the database without escaping. Consequently, any time an administrator opens the Real\u2011time Access Log report the script is rendered and executed, potentially enabling the attacker to steal session cookies, perform unauthorized actions, or deface the site. The core weakness is reflected in CWE\u201179. ", "risk_and_exploitability": "The vulnerability has a CVSS base score of 7.2, indicating high impact. The EPSS score is less than 1\u202f%, suggesting it is not widely exploited in the wild so far. The flaw is not listed in CISA\u2019s KEV catalog. The likely attack vector is an unauthenticated web request that injects a malicious `fh` value; this request can be crafted by an external attacker or a compromised user who can write to the database via the plugin\u2019s interface. Once the payload is stored, any administrator who views the report will trigger execution of the injected script."}}}}, "created": "2026-01-09T13:24:01.113596+00:00", "updated": "2026-04-21T16:45:15.210569+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wp-slimstat", "wp-slimstat$PRODUCT$slimstat_analytics"]}