SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce vulnerabilities
Plugin slug wp-slimstat · 28 known vulnerabilities · latest disclosed 2026-06-29 · WordPress.org page
Every listed vulnerability has a fix. Version 5.5.0 or later is not affected by any of them. If your site runs an older version, update it.
15 of 28 rated high or critical (CVSS 7 or more).
Known vulnerabilities in SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce
| Severity | Affected versions | Fixed in | CVE | Published | Details |
|---|---|---|---|---|---|
| High 7.2 | <= 5.4.0 | 5.5.0 | CVE-2026-12592 | 2026-06-29 | Advisory |
| Medium 6.5 | <= 5.4.11 | 5.4.12 | CVE-2026-54818 | 2026-06-17 | Advisory |
| High 8.1 | < 5.4.0 | 5.4.0 | CVE-2026-27410 | 2026-06-01 | Advisory |
| High 7.2 | <= 5.4.11 | 5.4.12 | CVE-2026-7634 | 2026-05-27 | Advisory |
| High 7.2 | <= 5.3.5 | 5.4.0 | CVE-2026-1238 | 2026-03-18 | Advisory |
| Medium 6.5 | <= 5.3.1 | 5.3.2 | CVE-2025-13431 | 2026-02-10 | Advisory |
| Medium 6.1 | <= 5.3.2 | 5.3.3 | CVE-2025-69323 | 2026-01-27 | Advisory |
| High 7.2 | <= 5.3.3 | 5.3.4 | CVE-2025-15057 | 2026-01-08 | Advisory |
| High 7.2 | <= 5.3.4 | 5.3.5 | CVE-2025-15055 | 2026-01-08 | Advisory |
| High 7.2 | <= 5.3.2 | 5.3.3 | CVE-2025-14151 | 2025-12-18 | Advisory |
| High 7.2 | <= 5.2.6 | 5.2.7 | CVE-2024-9548 | 2024-10-14 | Advisory |
| Medium 6.4 | <= 5.1.3 | 5.1.4 | CVE-2024-1073 | 2024-02-01 | Advisory |
| High 8.8 | <= 5.0.9 | 5.0.10 | CVE-2023-4598 | 2023-09-11 | Advisory |
| Medium 6.4 | <= 5.0.9 | 5.0.10 | CVE-2023-4597 | 2023-08-28 | Advisory |
| Medium 4.4 | <= 5.0.8 | 5.0.9 | CVE-2023-40676 | 2023-08-22 | Advisory |
| Medium 4.3 | <= 5.0.5.1 | 5.0.6 | CVE-2023-33994 | 2023-08-22 | Advisory |
| High 7.2 | <= 5.0.4 | 5.0.5 | CVE-2022-45373 | 2023-05-11 | Advisory |
| Medium 6.1 | <= 5.0.4 | 5.0.5 | CVE-2022-45366 | 2023-05-11 | Advisory |
| High 8.8 | <= 4.9.3.3 | 4.9.3.4 | none | 2023-03-30 | Advisory |
| High 8.8 | <= 4.9.3.2 | 4.9.3.3 | CVE-2023-0630 | 2023-02-23 | Advisory |
| High 7.2 | <= 4.9.2 | 4.9.3 | CVE-2022-4310 | 2022-12-19 | Advisory |
| Medium 6.1 | <= 4.9.2 | 4.9.3 | none | 2022-12-12 | Advisory |
| High 8.8 | < 4.8.4 | 4.8.4 | none | 2019-05-22 | Advisory |
| Medium 6.1 | <= 4.8 | 4.8.1 | CVE-2019-15112 | 2019-05-21 | Advisory |
| Medium 6.1 | < 4.1.6.1 | 4.1.6.1 | CVE-2015-9273 | 2015-07-22 | Advisory |
| High 8.2 | < 3.9.6 | 3.9.6 | none | 2015-02-24 | Advisory |
| Medium 6.1 | < 3.5.6 | 3.5.6 | CVE-2014-100027 | 2015-01-13 | Advisory |
| Medium 6.1 | < 3.9.3 | 3.9.3 | CVE-2015-1204 | 2015-01-06 | Advisory |
Check if a site is affected
Enter a site address to see which version of SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce and other plugins it runs, and whether they match a known vulnerability.
Questions
Is the SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce plugin safe to use?
All 28 known issues are fixed in current versions (5.5.0 or later). Keeping it updated is what matters.
How do I check which version of SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce my site runs?
In WordPress go to Plugins > Installed Plugins. From the outside, the free PluginPeek scan below reads the version from the site's public files.
How do I fix a vulnerable plugin?
Make a full backup, then update it from Dashboard > Updates and check the site afterwards. If you would rather not, we can do it for a fixed $99, paid after you have checked the site.