Known vulnerabilities in SlimStat Analytics

Real-time WordPress analytics that stay on your own server: pageviews, outbound links, WooCommerce funnels, all privacy-first and GDPR-ready.

25Reported vulnerabilities

8.8Highest CVSS score

5.5.0Latest version

70,000+Active installs

What to do now

Update SlimStat Analytics to 5.5.0 or later. 25 of these have a fixed version available. Updating resolves them.

Plugin last updated: June 24, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2023-4598	Medium 6.5	0.9%	Before 5.0.10	`5.0.10`	October 20, 2023
CVE-2015-1204	Medium 4.3	2.3%	3.9.1 and earlier	`3.9.3`	January 21, 2015
CVE-2014-100027	Medium 4.3	2.0%	3.5.5 and earlier	`3.5.6`	January 13, 2015
WF-af075ffe-553a-4351-a696-5c678788f3b9	High 8.8	—	4.9.3.3 and earlier	`4.9.3.4`	March 30, 2023
WF-f87e78c5-e7f4-4af6-b64f-444fef23e890	High 8.8	—	Before 4.8.4	`4.8.4`	May 22, 2019
CVE-2026-27410	High 8.1	0.3%	Before 5.4.0	`5.4.0`	June 1, 2026
WF-e2c11005-dcb3-40b3-863a-0612132acb08	High 8.2	—	Before 3.9.6	`3.9.6`	February 24, 2015
CVE-2026-12592	High 7.2	0.4%	5.4.0 and earlier	`5.5.0`	June 29, 2026
CVE-2026-7634	High 7.2	0.4%	0 to 5.4.11 (inclusive)	`5.4.12`	May 28, 2026
CVE-2026-1238	High 7.2	0.3%	0 to 5.3.5 (inclusive)	`5.4.0`	March 19, 2026
CVE-2025-15057	High 7.2	0.3%	0 to 5.3.3 (inclusive)	`5.3.4`	January 9, 2026
CVE-2025-15055	High 7.2	0.3%	0 to 5.3.4 (inclusive)	`5.3.5`	January 9, 2026
CVE-2025-14151	High 7.2	0.4%	0 to 5.3.2 (inclusive)	`5.3.3`	December 19, 2025
CVE-2022-45373	High 7.2	0.5%	5.0.4 and earlier	`5.0.5`	May 11, 2023
CVE-2026-54818	Medium 6.5	0.3%	5.4.11 and earlier	`5.4.12`	June 17, 2026
CVE-2025-13431	Medium 6.5	0.2%	0 to 5.3.1 (inclusive)	`5.3.2`	February 11, 2026
CVE-2023-4597	Medium 6.4	0.7%	5.0.9 and earlier	`5.0.10`	August 30, 2023
CVE-2019-15112	Medium 6.1	1.0%	Before 4.8.1	`4.8.1`	August 21, 2019
CVE-2024-9548	Medium 6.1	0.5%	Before 5.2.7	`5.2.7`	October 15, 2024
CVE-2025-69323	Medium 6.1	0.2%	5.3.2 and earlier	`5.3.3`	January 27, 2026
CVE-2022-45366	Medium 6.1	0.4%	5.0.4 and earlier	`5.0.5`	May 11, 2023
WF-9933ca13-32fd-4481-a18f-21e9a11c423c	Medium 6.1	—	4.9.2 and earlier	`4.9.3`	December 12, 2022
CVE-2024-1073	Medium 5.4	0.5%	5.1.3 and earlier	`5.1.4`	February 2, 2024
CVE-2023-40676	Medium 4.4	0.4%	5.0.8 and earlier	`5.0.9`	August 22, 2023
CVE-2023-33994	Medium 4.3	0.6%	5.0.5.1 and earlier	`5.0.6`	August 22, 2023

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.