The SlimStat Analytics plugin for WordPress contains a stored cross-site scripting vulnerability (CWE-79) in the 'notes' and 'resource' parameters due to inadequate input validation and output escaping. This allows unauthenticated attackers to inject arbitrary JavaScript that executes in the context of the administrator's browser when accessing the Recent Custom Events report. The vulnerability affects all versions up to 5.3.4. The CVSS 3.1 base score is 7.2, reflecting high severity with network attack vector, low complexity, no privileges or user interaction required, and impacts on confidentiality and integrity with scope change. No patch or remediation details are provided, and no exploits are known in the wild.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the administrator's browser context, potentially leading to disclosure or modification of sensitive information accessible to the admin user. The vulnerability impacts confidentiality and integrity but does not affect availability. The scope is changed, meaning the vulnerability affects components beyond the initial vulnerable component. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor veronalabs' communications for updates. Until a patch is available, consider restricting administrative access and limiting exposure of the Recent Custom Events report to trusted users only. Avoid using the vulnerable plugin versions in sensitive environments.