CVE-2026-12592 is a stored cross-site scripting vulnerability in the SlimStat Analytics WordPress plugin versions prior to 5.5.0. The issue occurs because the plugin fails to escape a geolocation value controlled by visitors before displaying it in admin analytics reports. An unauthenticated attacker can exploit this by injecting a malicious script via the geolocation data, which then executes in the context of an administrator's browser when they view the reports. This vulnerability specifically requires the plugin to be configured with the Cloudflare geolocation provider. The plugin is a cloud service, and a patch is available to address this issue.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the browser of an administrator who views the analytics reports. This could lead to session hijacking, unauthorized actions performed with administrator privileges, or other attacks facilitated by script execution in the admin context. The vulnerability is limited to environments where the Cloudflare geolocation provider is enabled in the plugin configuration.

A patch is available for this vulnerability. Users should upgrade the SlimStat Analytics WordPress plugin to version 5.5.0 or later to remediate the issue. Since this is a cloud service, the vendor typically manages remediation server-side; however, confirm with the vendor advisory for current patch deployment status. Until patched, disabling the Cloudflare geolocation provider in the plugin configuration may mitigate the risk by removing the attack vector.