{"id":1982,"date":"2023-09-11T15:24:48","date_gmt":"2023-09-11T14:24:48","guid":{"rendered":"https:\/\/ideiainternet.com\/?p=1982"},"modified":"2023-09-11T15:24:53","modified_gmt":"2023-09-11T14:24:53","slug":"xss-and-sqli-vulnerabilities-in-slimstat-analytics-plugin","status":"publish","type":"post","link":"https:\/\/ideiainternet.com\/en\/security-alerts\/xss-and-sqli-vulnerabilities-in-slimstat-analytics-plugin\/","title":{"rendered":"XSS and SQLi Vulnerabilities in Slimstat Analytics Plugin"},"content":{"rendered":"\n

On August 24, 2023, our Wordfence Threat Intelligence team identified and began the responsible disclosure process for a stored Cross-Site Scripting (XSS) and a Blind SQL Injection vulnerability in the Slimstat Analytics plugin, which is actively installed on more than 100,000 WordPress websites. The vulnerability enables threat actors with contributor-level permissions or higher to inject malicious web scripts into pages or execute SQL queries by appending them to an existing SQL query using the plugin\u2019s shortcode.<\/p>\n\n\n\n

We urge users to update their sites with the latest patched version of Slimstat Analytics, version 5.0.10 at the time of this writing, as soon as possible.<\/p>\n\n\n\n

\n
Read the complete article on the Wordfence blog<\/a><\/div>\n<\/div>\n\n\n\n

Vulnerabilities:<\/strong><\/p>\n\n\n\n

    \n
  1. Stored Cross-Site Scripting (XSS):<\/strong>\n
      \n
    • Affected Plugin: Slimstat Analytics<\/li>\n\n\n\n
    • CVE ID: CVE-2023-4597<\/li>\n\n\n\n
    • Description: Authenticated attackers with contributor-level access could inject harmful scripts into pages.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
    • Blind SQL Injection:<\/strong>\n
        \n
      • Affected Plugin: Slimstat Analytics<\/li>\n\n\n\n
      • CVE ID: CVE-2023-4598<\/li>\n\n\n\n
      • Description: Authenticated attackers with contributor-level access could execute SQL queries, potentially extracting sensitive data from the database.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n

        Disclosure Timeline:<\/strong><\/p>\n\n\n\n

          \n
        • August 24, 2023: Vulnerabilities discovered.<\/li>\n\n\n\n
        • August 28, 2023: Patch (version 5.0.10) released.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"

          On August 24, 2023, our Wordfence Threat Intelligence team identified and began the responsible disclosure process for a stored Cross-Site Scripting (XSS) and a Blind SQL Injection vulnerability in the Slimstat Analytics plugin, which is actively installed on more than 100,000 WordPress websites. The vulnerability enables threat actors with contributor-level permissions or higher to inject malicious…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_kad_blocks_custom_css":"","_kad_blocks_head_custom_js":"","_kad_blocks_body_custom_js":"","_kad_blocks_footer_custom_js":"","_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"_kad_post_classname":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-1982","post","type-post","status-publish","format-standard","hentry","category-security-alerts"],"yoast_head":"\nXSS and SQLi Vulnerabilities in Slimstat Analytics Plugin - ideia internet<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/ideiainternet.com\/en\/security-alerts\/xss-and-sqli-vulnerabilities-in-slimstat-analytics-plugin\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"XSS and SQLi Vulnerabilities in Slimstat Analytics Plugin - ideia internet\" \/>\n<meta property=\"og:description\" content=\"On August 24, 2023, our Wordfence Threat Intelligence team identified and began the responsible disclosure process for a stored Cross-Site Scripting (XSS) and a Blind SQL Injection vulnerability in the Slimstat Analytics plugin, which is actively installed on more than 100,000 WordPress websites. The vulnerability enables threat actors with contributor-level permissions or higher to inject malicious...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/ideiainternet.com\/en\/security-alerts\/xss-and-sqli-vulnerabilities-in-slimstat-analytics-plugin\/\" \/>\n<meta property=\"og:site_name\" content=\"ideia internet\" \/>\n<meta property=\"article:published_time\" content=\"2023-09-11T14:24:48+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-09-11T14:24:53+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/ideiainternet.com\/wp-content\/uploads\/2021\/05\/000aaa-vps.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"625\" \/>\n\t<meta property=\"og:image:height\" content=\"625\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"ideia internet\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@ideia_internet\" \/>\n<meta name=\"twitter:site\" content=\"@ideia_internet\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"ideia internet\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/ideiainternet.com\\\/security-alerts\\\/xss-and-sqli-vulnerabilities-in-slimstat-analytics-plugin\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/ideiainternet.com\\\/security-alerts\\\/xss-and-sqli-vulnerabilities-in-slimstat-analytics-plugin\\\/\"},\"author\":{\"name\":\"ideia internet\",\"@id\":\"https:\\\/\\\/ideiainternet.com\\\/#\\\/schema\\\/person\\\/e080a6b67c81951f76c132bcb8cb27d0\"},\"headline\":\"XSS and SQLi Vulnerabilities in Slimstat Analytics Plugin\",\"datePublished\":\"2023-09-11T14:24:48+00:00\",\"dateModified\":\"2023-09-11T14:24:53+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/ideiainternet.com\\\/security-alerts\\\/xss-and-sqli-vulnerabilities-in-slimstat-analytics-plugin\\\/\"},\"wordCount\":179,\"publisher\":{\"@id\":\"https:\\\/\\\/ideiainternet.com\\\/#organization\"},\"articleSection\":[\"Security Alerts\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/ideiainternet.com\\\/security-alerts\\\/xss-and-sqli-vulnerabilities-in-slimstat-analytics-plugin\\\/\",\"url\":\"https:\\\/\\\/ideiainternet.com\\\/security-alerts\\\/xss-and-sqli-vulnerabilities-in-slimstat-analytics-plugin\\\/\",\"name\":\"XSS and SQLi Vulnerabilities in Slimstat Analytics Plugin - ideia internet\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/ideiainternet.com\\\/#website\"},\"datePublished\":\"2023-09-11T14:24:48+00:00\",\"dateModified\":\"2023-09-11T14:24:53+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/ideiainternet.com\\\/security-alerts\\\/xss-and-sqli-vulnerabilities-in-slimstat-analytics-plugin\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/ideiainternet.com\\\/security-alerts\\\/xss-and-sqli-vulnerabilities-in-slimstat-analytics-plugin\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/ideiainternet.com\\\/security-alerts\\\/xss-and-sqli-vulnerabilities-in-slimstat-analytics-plugin\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/ideiainternet.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"XSS and SQLi Vulnerabilities in Slimstat Analytics Plugin\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/ideiainternet.com\\\/#website\",\"url\":\"https:\\\/\\\/ideiainternet.com\\\/\",\"name\":\"ideia internet\",\"description\":\"Cloud Hosting\",\"publisher\":{\"@id\":\"https:\\\/\\\/ideiainternet.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/ideiainternet.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/ideiainternet.com\\\/#organization\",\"name\":\"ideia internet\",\"url\":\"https:\\\/\\\/ideiainternet.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/ideiainternet.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/ideiainternet.com\\\/wp-content\\\/uploads\\\/2021\\\/05\\\/ideia-internet-logo-green.png\",\"contentUrl\":\"https:\\\/\\\/ideiainternet.com\\\/wp-content\\\/uploads\\\/2021\\\/05\\\/ideia-internet-logo-green.png\",\"width\":1904,\"height\":1637,\"caption\":\"ideia internet\"},\"image\":{\"@id\":\"https:\\\/\\\/ideiainternet.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/ideia_internet\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/ideiainternet.com\\\/#\\\/schema\\\/person\\\/e080a6b67c81951f76c132bcb8cb27d0\",\"name\":\"ideia internet\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e0291766f903f1ccbebf466faea67828934c4bc70a9fecab6faf64c0ada4ff29?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e0291766f903f1ccbebf466faea67828934c4bc70a9fecab6faf64c0ada4ff29?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e0291766f903f1ccbebf466faea67828934c4bc70a9fecab6faf64c0ada4ff29?s=96&d=mm&r=g\",\"caption\":\"ideia internet\"},\"sameAs\":[\"https:\\\/\\\/ideiainternet.com\"],\"url\":\"https:\\\/\\\/ideiainternet.com\\\/en\\\/author\\\/admin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"XSS and SQLi Vulnerabilities in Slimstat Analytics Plugin - ideia internet","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/ideiainternet.com\/en\/security-alerts\/xss-and-sqli-vulnerabilities-in-slimstat-analytics-plugin\/","og_locale":"en_US","og_type":"article","og_title":"XSS and SQLi Vulnerabilities in Slimstat Analytics Plugin - ideia internet","og_description":"On August 24, 2023, our Wordfence Threat Intelligence team identified and began the responsible disclosure process for a stored Cross-Site Scripting (XSS) and a Blind SQL Injection vulnerability in the Slimstat Analytics plugin, which is actively installed on more than 100,000 WordPress websites. The vulnerability enables threat actors with contributor-level permissions or higher to inject malicious...","og_url":"https:\/\/ideiainternet.com\/en\/security-alerts\/xss-and-sqli-vulnerabilities-in-slimstat-analytics-plugin\/","og_site_name":"ideia internet","article_published_time":"2023-09-11T14:24:48+00:00","article_modified_time":"2023-09-11T14:24:53+00:00","og_image":[{"width":625,"height":625,"url":"https:\/\/ideiainternet.com\/wp-content\/uploads\/2021\/05\/000aaa-vps.jpg","type":"image\/jpeg"}],"author":"ideia internet","twitter_card":"summary_large_image","twitter_creator":"@ideia_internet","twitter_site":"@ideia_internet","twitter_misc":{"Written by":"ideia internet","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/ideiainternet.com\/security-alerts\/xss-and-sqli-vulnerabilities-in-slimstat-analytics-plugin\/#article","isPartOf":{"@id":"https:\/\/ideiainternet.com\/security-alerts\/xss-and-sqli-vulnerabilities-in-slimstat-analytics-plugin\/"},"author":{"name":"ideia internet","@id":"https:\/\/ideiainternet.com\/#\/schema\/person\/e080a6b67c81951f76c132bcb8cb27d0"},"headline":"XSS and SQLi Vulnerabilities in Slimstat Analytics Plugin","datePublished":"2023-09-11T14:24:48+00:00","dateModified":"2023-09-11T14:24:53+00:00","mainEntityOfPage":{"@id":"https:\/\/ideiainternet.com\/security-alerts\/xss-and-sqli-vulnerabilities-in-slimstat-analytics-plugin\/"},"wordCount":179,"publisher":{"@id":"https:\/\/ideiainternet.com\/#organization"},"articleSection":["Security Alerts"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/ideiainternet.com\/security-alerts\/xss-and-sqli-vulnerabilities-in-slimstat-analytics-plugin\/","url":"https:\/\/ideiainternet.com\/security-alerts\/xss-and-sqli-vulnerabilities-in-slimstat-analytics-plugin\/","name":"XSS and SQLi Vulnerabilities in Slimstat Analytics Plugin - ideia internet","isPartOf":{"@id":"https:\/\/ideiainternet.com\/#website"},"datePublished":"2023-09-11T14:24:48+00:00","dateModified":"2023-09-11T14:24:53+00:00","breadcrumb":{"@id":"https:\/\/ideiainternet.com\/security-alerts\/xss-and-sqli-vulnerabilities-in-slimstat-analytics-plugin\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/ideiainternet.com\/security-alerts\/xss-and-sqli-vulnerabilities-in-slimstat-analytics-plugin\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/ideiainternet.com\/security-alerts\/xss-and-sqli-vulnerabilities-in-slimstat-analytics-plugin\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/ideiainternet.com\/"},{"@type":"ListItem","position":2,"name":"XSS and SQLi Vulnerabilities in Slimstat Analytics Plugin"}]},{"@type":"WebSite","@id":"https:\/\/ideiainternet.com\/#website","url":"https:\/\/ideiainternet.com\/","name":"ideia internet","description":"Cloud Hosting","publisher":{"@id":"https:\/\/ideiainternet.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/ideiainternet.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/ideiainternet.com\/#organization","name":"ideia internet","url":"https:\/\/ideiainternet.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/ideiainternet.com\/#\/schema\/logo\/image\/","url":"https:\/\/ideiainternet.com\/wp-content\/uploads\/2021\/05\/ideia-internet-logo-green.png","contentUrl":"https:\/\/ideiainternet.com\/wp-content\/uploads\/2021\/05\/ideia-internet-logo-green.png","width":1904,"height":1637,"caption":"ideia internet"},"image":{"@id":"https:\/\/ideiainternet.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/ideia_internet"]},{"@type":"Person","@id":"https:\/\/ideiainternet.com\/#\/schema\/person\/e080a6b67c81951f76c132bcb8cb27d0","name":"ideia internet","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/e0291766f903f1ccbebf466faea67828934c4bc70a9fecab6faf64c0ada4ff29?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/e0291766f903f1ccbebf466faea67828934c4bc70a9fecab6faf64c0ada4ff29?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e0291766f903f1ccbebf466faea67828934c4bc70a9fecab6faf64c0ada4ff29?s=96&d=mm&r=g","caption":"ideia internet"},"sameAs":["https:\/\/ideiainternet.com"],"url":"https:\/\/ideiainternet.com\/en\/author\/admin\/"}]}},"taxonomy_info":{"category":[{"value":1,"label":"Security Alerts"}]},"featured_image_src_large":false,"author_info":{"display_name":"ideia internet","author_link":"https:\/\/ideiainternet.com\/en\/author\/admin\/"},"comment_info":0,"category_info":[{"term_id":1,"name":"Security Alerts","slug":"security-alerts","term_group":0,"term_taxonomy_id":1,"taxonomy":"category","description":"","parent":0,"count":2,"filter":"raw","cat_ID":1,"category_count":2,"category_description":"","cat_name":"Security Alerts","category_nicename":"security-alerts","category_parent":0}],"tag_info":false,"_links":{"self":[{"href":"https:\/\/ideiainternet.com\/en\/wp-json\/wp\/v2\/posts\/1982","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ideiainternet.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ideiainternet.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ideiainternet.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ideiainternet.com\/en\/wp-json\/wp\/v2\/comments?post=1982"}],"version-history":[{"count":0,"href":"https:\/\/ideiainternet.com\/en\/wp-json\/wp\/v2\/posts\/1982\/revisions"}],"wp:attachment":[{"href":"https:\/\/ideiainternet.com\/en\/wp-json\/wp\/v2\/media?parent=1982"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ideiainternet.com\/en\/wp-json\/wp\/v2\/categories?post=1982"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ideiainternet.com\/en\/wp-json\/wp\/v2\/tags?post=1982"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}