CVE-2026-7634

Executive Summary

CVE-2026-7634 is a Stored Cross-Site Scripting (XSS) vulnerability in the SlimStat Analytics WordPress plugin, affecting all versions up to and including 5.4.11. The flaw resides in the insufficient sanitization of the User-Agent HTTP header, which is stored and later rendered in the plugin’s administrative interface. An unauthenticated attacker can inject arbitrary JavaScript payloads via the User-Agent header. The stored payload executes when an administrator accesses the affected page, but only if the show_complete_user_agent_tooltip setting is explicitly enabled (disabled by default). This vulnerability is part of the WordPress ecosystem and does not involve Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The plugin is installed directly on WordPress sites, and the risk is limited to sites where the vulnerable plugin version is active and the specific setting is enabled.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – an administrator must access the page
• Scope: Changed (S:C) – the vulnerability impacts resources beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: High. Although exploitation requires the show_complete_user_agent_tooltip setting to be enabled, the attack is unauthenticated and can lead to session hijacking, defacement, or data theft within the WordPress admin context.

Deep Dive & Mechanics

The vulnerability exists in the SlimStat Analytics plugin’s handling of the User-Agent HTTP header. When a request is made to a WordPress site with the plugin active, the plugin logs the User-Agent string. In the administrative interface, the plugin displays this data. The show_complete_user_agent_tooltip setting, when enabled, renders the full User-Agent string in a tooltip without proper output escaping.

Root Cause: The plugin uses esc_attr() or similar functions insufficiently, or fails to escape the User-Agent value before rendering it in an HTML attribute context. This allows an attacker to inject JavaScript code that is stored in the database and executed when an admin views the tooltip.

Attack Flow:

1. Attacker sends an HTTP request to the target WordPress site with a malicious User-Agent header containing JavaScript payload (e.g., <script>alert('XSS')</script>).
2. The plugin logs the request and stores the User-Agent string in the database.
3. An administrator accesses the SlimStat Analytics dashboard and hovers over a user agent entry, triggering the tooltip.
4. The stored payload executes in the admin’s browser context, potentially stealing cookies, performing actions on behalf of the admin, or defacing the site.

Prerequisite: The show_complete_user_agent_tooltip setting must be enabled by an administrator. By default, it is disabled, which reduces the attack surface.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a conceptual comparison based on the vulnerability description.

Vulnerable Code (Conceptual):

// In a template or display function
$user_agent = $row['user_agent']; // Directly from database
echo '<span title="' . $user_agent . '">' . esc_html($user_agent) . '</span>';

Here, the title attribute is not escaped, allowing XSS.

Patched Code (Conceptual):

$user_agent = $row['user_agent'];
echo '<span title="' . esc_attr($user_agent) . '">' . esc_html($user_agent) . '</span>';

The esc_attr() function properly escapes the string for HTML attribute context.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Target WordPress site with SlimStat Analytics <= 5.4.11 installed and active.
• The show_complete_user_agent_tooltip setting must be enabled by an administrator.

Exploitation Steps:

1. Identify the target WordPress site.
2. Send an HTTP request with a malicious User-Agent header:

   curl -X GET "http://target-site.com/" -H "User-Agent: <script>alert('XSS')</script>"
   

3. Wait for an administrator to view the SlimStat Analytics dashboard and hover over the user agent entry.
4. The payload executes in the admin’s browser.

Advanced Payload Example:

curl -X GET "http://target-site.com/" -H "User-Agent: <img src=x onerror=alert(document.cookie)>"

Blue Team (Defender)

Detection:

• Monitor HTTP request logs for suspicious User-Agent strings containing HTML/JavaScript.
• Use WAF rules to block requests with script tags in User-Agent headers.
• Review SlimStat Analytics settings to ensure show_complete_user_agent_tooltip is disabled.

Hunting:

• Search for stored XSS indicators in the WordPress database:

  SELECT * FROM wp_slimstat WHERE user_agent LIKE '%<script%' OR user_agent LIKE '%onerror%';
  

• Check for unusual User-Agent strings in web server logs.

Indicators of Compromise (IOCs)

• Network:

  • HTTP requests with User-Agent headers containing <script>, <img, onerror, onload, or other HTML/JavaScript constructs.
  • Unusual User-Agent strings that are not typical browsers (e.g., long strings with special characters).

• Host:

  • WordPress database entries in the wp_slimstat table with user_agent fields containing HTML/JavaScript.
  • Presence of unexpected JavaScript in the SlimStat Analytics admin pages.

• File:

  • Modified plugin files (though unlikely for this stored XSS).

Detection Engineering

YARA Rule

rule SlimStat_Stored_XSS_UserAgent {
    meta:
        description = "Detects stored XSS payloads in SlimStat Analytics User-Agent logs"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-7634"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<img[^>]*onerror[^>]*>/is
        $xss3 = /<svg[^>]*onload[^>]*>/is
    condition:
        any of them
}

Sigma Rule

title: SlimStat Analytics Stored XSS via User-Agent Header
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with malicious User-Agent headers targeting SlimStat Analytics
author: Valters IT
date: 2026/01/01
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-user-agent|contains:
            - '<script'
            - '<img'
            - 'onerror'
            - 'onload'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate security scanners
level: high

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-7634 SlimStat Analytics Stored XSS via User-Agent"; flow:to_server; content:"User-Agent|3a|"; http_header; pcre:"/User-Agent\x3a[^\r\n]*<script/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the show_complete_user_agent_tooltip setting in SlimStat Analytics settings (default is disabled).
2. Update the plugin to a patched version if/when released. Monitor the WordPress plugin repository for updates.
3. Implement a Web Application Firewall (WAF) rule to block malicious User-Agent headers containing HTML/JavaScript.
4. Review and clean the wp_slimstat database table for any existing malicious entries.

Long-term Measures:

• Enforce strict input validation and output escaping for all user-supplied data in WordPress plugins.
• Conduct regular security audits of third-party plugins.
• Educate administrators about the risks of enabling debug or verbose settings.

Workaround:

• If the plugin cannot be updated, consider disabling the SlimStat Analytics plugin entirely until a patch is available.

Report generated by Valters IT DevSecOps & CTI Division