The SlimStat Analytics plugin for WordPress suffers from a stored XSS vulnerability due to insufficient input sanitization and output escaping of the 'fh' parameter. This flaw allows unauthenticated attackers to inject arbitrary JavaScript code into the database, which executes in the context of the administrator's browser when viewing the Real-time Access Log report. The vulnerability affects all versions up to and including 5.3.3. The CVSS v3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity with scope change.

Successful exploitation can lead to execution of arbitrary scripts in the administrator's browser, potentially compromising administrative credentials or session tokens, leading to unauthorized access or manipulation of the WordPress site. The vulnerability does not impact availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting access to the Real-time Access Log report to trusted users only and monitor for suspicious input in the 'fh' parameter. Avoid interacting with untrusted fingerprint data. Follow vendor channels for updates on patches or official mitigations.