CVE-2026-7634 is a stored cross-site scripting vulnerability in the SlimStat Analytics plugin for WordPress, affecting all versions up to and including 5.4.11. The vulnerability arises from improper neutralization of input in the 'User-Agent' header, allowing injection of arbitrary web scripts. These scripts execute when a user accesses a page rendering the injected content. Exploitation requires that the show_complete_user_agent_tooltip setting be enabled by an administrator, which is not enabled by default. The vulnerability has a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with scope change.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to steal sensitive information or perform actions on behalf of users. The impact is limited by the requirement that the show_complete_user_agent_tooltip setting be enabled, which is disabled by default. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should ensure the show_complete_user_agent_tooltip setting remains disabled to prevent exploitation. Monitor official vendor channels for updates and apply any released patches promptly.