CVE-2024-1073 is a stored cross-site scripting vulnerability in the SlimStat Analytics plugin for WordPress, affecting all versions up to and including 5.1.3. The vulnerability is due to improper neutralization of input in the 'filter_array' parameter, allowing authenticated users with subscriber-level privileges or higher to inject arbitrary web scripts. These scripts execute when other users access the injected pages, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 base score is 6.4 (medium), with network attack vector, low attack complexity, and privileges required at the low level without user interaction.

An attacker with subscriber-level access or higher can inject persistent malicious scripts into pages viewed by other users. This can lead to unauthorized actions performed in the context of other users' sessions, information disclosure, or other impacts typical of stored XSS vulnerabilities. However, the impact is limited by the requirement for authenticated access and the absence of reported active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access carefully and consider disabling or limiting use of the SlimStat Analytics plugin. Monitor vendor channels for updates or patches addressing this vulnerability.