Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

SlimStat Analytics Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 28 vulnerability records associated with SlimStat Analytics, published between 2015 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

28Total records
0Critical
15High
13Medium
0Low
0Informational
28Patched records
0Currently marked unpatched
2015-01-06First disclosure
2026-06-29Latest disclosure
24 of 28CVE coverage

Year-by-Year Timeline

YearRecordsRelative volume
201544 records
201922 records
202222 records
202388 records
202422 records
202511 records
202699 records

Severity Breakdown

SeverityRecordsShare
High1553.6%
Medium1346.4%

Vulnerability-Type Breakdown

Cross-Site Scripting

18 records64.3%

First: 2015. Latest: 2026.

SQL Injection

7 records25%

First: 2015. Latest: 2026.

CSRF

1 record3.6%

First: 2019. Latest: 2019.

Missing Authorization

1 record3.6%

First: 2023. Latest: 2023.

Other

1 record3.6%

First: 2026. Latest: 2026.

Patch Status

Patched
28
Currently marked unpatched
0
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 5.5.0
  • 5.4.12
  • 5.4.0
  • 5.3.2
  • 5.3.3
  • 5.3.4
  • 5.3.5
  • 5.2.7
  • 5.1.4
  • 5.0.10
  • 5.0.6
  • 5.0.9
  • 5.0.5
  • 4.9.3.4
  • 4.9.3.3
  • 4.9.3
  • 4.8.4
  • 4.8.1
  • 4.1.6.1
  • 3.9.6
  • 3.5.6
  • 3.9.3

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
*-5.4.0SlimStat Analytics <= 5.4.0 - Unauthenticated Stored Cross-Site ScriptingJune 29, 20265.5.0High
*-5.4.11SlimStat Analytics <= 5.4.11 - Authenticated (Subscriber+) SQL InjectionJune 17, 20265.4.12Medium
[*, 5.4.0)SlimStat Analytics < 5.4.0 - Unauthenticated PHP Object InjectionJune 1, 20265.4.0High
*-5.4.11SlimStat Analytics <= 5.4.11 - Unauthenticated Stored Cross-Site Scripting via User-Agent HeaderMay 27, 20265.4.12High
*-5.3.5SlimStat Analytics <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via 'fh'March 18, 20265.4.0High
*-5.3.1SlimStat Analytics <= 5.3.1 - Authenticated (Subscriber+) SQL Injection via `args` ParameterFebruary 10, 20265.3.2Medium
*-5.3.2Slimstat Analytics <= 5.3.2 - Reflected Cross-Site ScriptingJanuary 27, 20265.3.3Medium
*-5.3.3SlimStat Analytics <= 5.3.3 - Unauthenticated Stored Cross-Site Scripting via 'fh' ParameterJanuary 8, 20265.3.4High
*-5.3.4SlimStat Analytics <= 5.3.4 - Unauthenticated Stored Cross-Site Scripting via 'notes/resource' ParametersJanuary 8, 20265.3.5High
*-5.3.2SlimStat Analytics <= 5.3.2 - Unauthenticated Stored Cross-Site ScriptingDecember 18, 20255.3.3High
*-5.2.6Slimstat Analytics <= 5.2.6 - Unauthenticated Stored Cross-Site ScriptingOctober 14, 20245.2.7High
*-5.1.3SlimStat Analytics <= 5.1.3 - Authenticated (Subscriber+) Stored Cross-Site ScriptingFebruary 1, 20245.1.4Medium
*-5.0.9Slimstat Analytics <= 5.0.9 - Authenticated (Contributor+) Blind SQL Injection via ShortcodeSeptember 11, 20235.0.10High
*-5.0.9Slimstat Analytics <= 5.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeAugust 28, 20235.0.10Medium
*-5.0.5.1Slimstat Analytics <= 5.0.5.1 - Missing Authorization via delete_pageviewAugust 22, 20235.0.6Medium
*-5.0.8Slimstat Analytics <= 5.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via settingsAugust 22, 20235.0.9Medium
*-5.0.4Slimstat Analytics <= 5.0.4 - Reflected Cross-Site ScriptingMay 11, 20235.0.5Medium
*-5.0.4Slimstat Analytics <= 5.0.4 - Authenticated (Administrator+) SQL InjectionMay 11, 20235.0.5High
*-4.9.3.3Slimstat Analytics <= 4.9.3.3 - Authenticated (Subscriber+) SQL Injection via ShortcodeMarch 30, 20234.9.3.4High
*-4.9.3.2Slimstat Analytics <= 4.9.3.2 - Authenticated (Subscriber+) SQL Injection via ShortcodeFebruary 23, 20234.9.3.3High
*-4.9.2Slimstat Analytics <= 4.9.2 - Unauthenticated Stored Cross-Site ScriptingDecember 19, 20224.9.3High
*-4.9.2Slimstat Analytics <= 4.9.2 - Reflected Cross-Site Scripting via REQUEST_URIDecember 12, 20224.9.3Medium
[*, 4.8.4)Slimstat Analytics <= 4.8.3 - Cross-Site Request Forgery to Stored Cross-Site ScriptingMay 22, 20194.8.4High
*-4.8WP Slimstat <= 4.8 - Unauthenticated Stored Cross-Site Scripting from VisitorsMay 21, 20194.8.1Medium
[*, 4.1.6.1)Slimstat Analytics < 4.1.6.1 - Cross-Site ScriptingJuly 22, 20154.1.6.1Medium

Selected source records

Latest Records

HighCVE-2026-12592

SlimStat Analytics <= 5.4.0 - Unauthenticated Stored Cross-Site Scripting

Published: June 29, 2026

Affected versions
*-5.4.0
Patched versions
5.5.0
Original Wordfence record
MediumCVE-2026-54818

SlimStat Analytics <= 5.4.11 - Authenticated (Subscriber+) SQL Injection

Published: June 17, 2026

Affected versions
*-5.4.11
Patched versions
5.4.12
Original Wordfence record
HighCVE-2026-27410

SlimStat Analytics < 5.4.0 - Unauthenticated PHP Object Injection

Published: June 1, 2026

Affected versions
[*, 5.4.0)
Patched versions
5.4.0
Original Wordfence record
HighCVE-2026-7634

SlimStat Analytics <= 5.4.11 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header

Published: May 27, 2026

Affected versions
*-5.4.11
Patched versions
5.4.12
Original Wordfence record
HighCVE-2026-1238

SlimStat Analytics <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via 'fh'

Published: March 18, 2026

Affected versions
*-5.3.5
Patched versions
5.4.0
Original Wordfence record
MediumCVE-2025-13431

SlimStat Analytics <= 5.3.1 - Authenticated (Subscriber+) SQL Injection via `args` Parameter

Published: February 10, 2026

Affected versions
*-5.3.1
Patched versions
5.3.2
Original Wordfence record
MediumCVE-2025-69323

Slimstat Analytics <= 5.3.2 - Reflected Cross-Site Scripting

Published: January 27, 2026

Affected versions
*-5.3.2
Patched versions
5.3.3
Original Wordfence record
HighCVE-2025-15057

SlimStat Analytics <= 5.3.3 - Unauthenticated Stored Cross-Site Scripting via 'fh' Parameter

Published: January 8, 2026

Affected versions
*-5.3.3
Patched versions
5.3.4
Original Wordfence record

Highest-Severity Records

HighCVE-2023-4598

Slimstat Analytics <= 5.0.9 - Authenticated (Contributor+) Blind SQL Injection via Shortcode

Published: September 11, 2023

Affected versions
*-5.0.9
Patched versions
5.0.10
Original Wordfence record
High

Slimstat Analytics <= 4.9.3.3 - Authenticated (Subscriber+) SQL Injection via Shortcode

Published: March 30, 2023

Affected versions
*-4.9.3.3
Patched versions
4.9.3.4
Original Wordfence record
High

Slimstat Analytics <= 4.8.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Published: May 22, 2019

Affected versions
[*, 4.8.4)
Patched versions
4.8.4
Original Wordfence record
HighCVE-2023-0630

Slimstat Analytics <= 4.9.3.2 - Authenticated (Subscriber+) SQL Injection via Shortcode

Published: February 23, 2023

Affected versions
*-4.9.3.2
Patched versions
4.9.3.3
Original Wordfence record
High

Slimstat Analytics < 3.9.6 - Unauthenticated Blind SQL Injection

Published: February 24, 2015

Affected versions
[*, 3.9.6)
Patched versions
3.9.6
Original Wordfence record
HighCVE-2026-27410

SlimStat Analytics < 5.4.0 - Unauthenticated PHP Object Injection

Published: June 1, 2026

Affected versions
[*, 5.4.0)
Patched versions
5.4.0
Original Wordfence record
HighCVE-2026-7634

SlimStat Analytics <= 5.4.11 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header

Published: May 27, 2026

Affected versions
*-5.4.11
Patched versions
5.4.12
Original Wordfence record
HighCVE-2022-4310

Slimstat Analytics <= 4.9.2 - Unauthenticated Stored Cross-Site Scripting

Published: December 19, 2022

Affected versions
*-4.9.2
Patched versions
4.9.3
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory